did you declare a user for anonymous in the sqlcc admin page which has rights to access to your package ?:
https://yourhana.server.com:4300/sap/hana/xs/sqlcc
if you are only doing GET, then it may be easier to use JSONP, but JSONP does not support POST so if you need both then you need CORS.
Best
Denis