title: No 'Access-Control-Allow-Origin' header for exportLink
body: <p>I have a basic javascript snippet to download a <strong>publically shared file</strong> from google drive. I created an API key and configured my domain to be on the list of allowed referrers. I get the typical CORS error when trying to open the exportLink as described here <a href="https://developers.google.com/drive/web/manage-downloads" rel="nofollow">https://developers.google.com/drive/web/manage-downloads</a>. The download link works just fine when accessed in the browser.</p>
  
  <p><strong>Error:</strong></p>
  
  <pre><code>No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://www.example.com' is therefore not allowed access.
  </code></pre>
  
  <p><strong>Code:</strong></p>
  
  <pre><code>// setup api key
  gapi.client.setApiKey('myKey');
  
  // load libraries and get file from drive API
  ...
  
  // download file 
  
  var xhr = new XMLHttpRequest();
  xhr.open('GET', file['exportLinks']['text/csv']);
  xhr.onload = function() {
      callback(xhr.responseText);
  };
  xhr.onerror = function() {
      callback(null);
  };
  xhr.send();
  </code></pre>