load data from CORS enabled site

what Origin should I set for CORS enabled site?

for a test json file on a CORS enabled site, a google cloud storage bucket here; https://test-cors-bkt.storage.googleapis.com/test.json

http://blockbuilder.org/anonymous/8b252921b89922838cd25461ef73710c (this one always not working, weather I added Origin http://blockbuilder.org or not, )

the error from JS console: from Network entries, I can see the difference with bl.ocks.org below is this one sent `Origin: null` on the request

```js
XMLHttpRequest cannot load https://test-cors-bkt.storage.googleapis.com/test.json. The 'Access-Control-Allow-Origin' header has a value 'http://bl.ocks.org' that is not equal to the supplied origin. Origin 'null' is therefore not allowed access.
blob:http://blockbuilder.org/69347bc3-1207-4af7-bb18-e03aa7eab6b0:149 the data: undefined
blob:http://blockbuilder.org/69347bc3-1207-4af7-bb18-e03aa7eab6b0:3 Uncaught DOMException: Failed to execute 'postMessage' on 'Window': An object could not be cloned.
at XMLHttpRequest.window.onerror (blob:http://blockbuilder.org/69347bc3-1207-4af7-bb18-e03aa7eab6b0:3:21)
```


As a comparison:
=====================

http://bl.ocks.org/anonymous/8b252921b89922838cd25461ef73710c (I have "http://bl.ocks.org" into my gs://test-cors-bkt/ so it serves when Origin is http://bl.ocks.org, I didn't add https://bl.ocks.org so the same code on https://bl.ocks.org/anonymous/8b252921b89922838cd25461ef73710c doesn't work)