1. CORS is allowed on Guardium appliance for REST API requests especially to support such client.
2. I wrote a pure javascript client a few years ago, can't find the code - I do remember it was not simple, it required two phase requests with first one being an OPTIONS request and after that the actual GET/POST API request.
I think javascript frameworks such as jquery and others can make it easier.
Good luck
------------------------------
GUY GALIL
------------------------------