Are you running HANA SP6? If so you can allow CORS via the .xsaccess file now. For example:
{
"exposed": true,
"authentication": [{ "method": "LogonTicket" },{ "method" : "Basic" }],
"cors" : [{ "enabled":true }],
"cache_control" : "must-revalidate"
}