Cross Origin Resource Sharing lets servers support cross-origin Javascript. It is supported by the latest browsers (although IE support is… different), and involves sending CORS headers in responses.
Adding this enables Javascript code running in a browser to connect with any bitcoin/bitcoind that allows RPC connections from the browser’s IP address and has the right rpc username/password.