Request header field X-CSRF-Token is not allowed by Access-Control-Allow-Headers in preflight response for Drupal 7 REST API
Have a look at cors module
You'll be able to add necessary Access-Control-Allow-Headers

Otherwise, you can do this by changing your apache (or nginx or whatever) conf.

In drupal 8, you define this in services.yml, as explain here.