Simple CORS using .htaccess file.

Cross-Origin Resource Sharing (CORS) allows web browser to validate and web server to provide a way to consume and provide cross-site content and access controls.

To make Drupal 8 respond to remote calls you should wait for the core issue https://www.drupal.org/node/1869548 which is postponed until Drupal 8.1.x or wait for the D8 version of https://www.drupal.org/project/cors

The alternative is using .htaccess and open up your Drupal install for the whole world use the settings below.

Header always set Access-Control-Allow-Origin "*"
Header always set Access-Control-Allow-Methods "POST, GET, OPTIONS, PATCH, DELETE"
Header always set Access-Control-Allow-Headers: Authorization

Make sure you reduce origin to a list of IPs or domains and the methods to e.g. only GET

For more info see https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS