title: firebase storage cors strange Behaviour
body: <p>I'm building an app in witch the user see a set of  downsized images and than press " ok" for the app to download all of the original files, put them into a zip file and send the zip file.</p>
  
  <p>the app is using polymer, polymerfire, firebase (including the storage).</p>
  
  <p>during the upload of the images i save in the database both the download url and the storage reference for both the original file and the downsized one. </p>
  
  <p>when i put the download url in the iron-image element to show the images in the browser everything works perfectly, the downsized images are shown on the screen. 
  When i try to download the fullsize images via XMLHttpRequest() i get the Cors error. 
  I can't understand why, both request are coming from the same app, why two different cors response?</p>
  
  <p>here is the code for the XMLHttpRequest() (mostly copied from the firebase documentation):</p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-js lang-js prettyprint-override"><code>for (var z = 0; z &lt; visita.immagini.length; z++) {
    var immagine =visita.immagini[z]
  
    var storage = firebase.storage();
    var pathReference = storage.ref('immagini/'+ immagine.original.ref);
    pathReference.getDownloadURL().then(function(url) {
  
      var xhr = new XMLHttpRequest();
      xhr.responseType = 'blob';
      xhr.onload = function(event) {
        var blob = xhr.response;
        console.log(blob);
      };
      xhr.open('GET', url);
      xhr.send();
    }).catch(function(error) {
        console.log(error);
    });
  
  }</code></pre>
  </div>
  </div>
  </p>
  
  <p>and here is the error response: </p>
  
  <blockquote>
    <p>XMLHttpRequest cannot load ***** [image link]******. No
    'Access-Control-Allow-Origin' header is present on the requested
    resource. Origin '<a href="http://localhost:3000" rel="nofollow noreferrer">http://localhost:3000</a>' is therefore not allowed
    access.</p>
  </blockquote>
  
  <p>note that if i copy the <code>***** [image link]******</code> and put in another tab of the browser i can see without problems.</p>