I don't think its CORS.
I've put in a temporary shim at my end to let requests without l=localpart be resolved by my WKD service... so now keyoxide (website) retrieves my key and all is good... and when I expand the details of the wkd its clearly showing the correct link but again without l=localpart... I think your(web) end is failing to correctly create the path to query.