I thought I would try an authenticated request of the odata service, so edited the .xsaccess as provided above to give:
{
"exposed":true
}
I was prompted for basic authentication and response correct with expected data. So URI and service works, just the crossDomain at issue.