Ok, this is failing because CORS headers are not set.
But you are also making the call from the browser (in the form), which is a bad idea when you have to pass credentials.
Move the code to the server to avoid CORS issues but also to hide your credentials from the browser.