How do I enable CORS?
Doing this in an .htaccess should be OK.

Doing it in the Apache config for the host (main httpd.conf, include for the vhost, etc) is better.  When you upgrade Drupal, the .htaccess will be nuked.  Also, .htaccess is interpreted for every single access; Apache config (including Includes) is compiled when Apache starts.

You can also use drupal_set_header().  You just need to use the right hook for your situation (not terribly familiar with the Services hooks).

drupal_set_header('Access-Control-Allow-Origin: "*" IS_CORS');
drupal_set_header('Access-Control-Allow-Methods: PUT, GET, POST, DELETE, OPTIONS');
drupal_set_header('Access-Control-Allow-Headers: x-requested-with');


You may also want to check out the H5BP Server Configs project.  I use bits and pieces of this as Apache includes for my virtual hosts, and I am pretty sure they have some good CORS rules.