Note. My main intention is to get around CORS issues with a service
It seems to me that any service that you use forces to redirect, for example, @Steve comment. They can cause HTTP_REFERER to be a specific domain. Since I do not know what service you are calling, this is just an assumption.