2) Honestly never heard of CORS. Generally what I do for local content to be global is I run PHP on the local machine that CURLs to an external address. Implementing the online server in #1 would get this to work as long as there was internet connectivity obviously. But if you are doing cross-domain calls, I assume your network is internet connected? What sort of latency is acceptable to you? If you say "go on" it might take a couple hundred milliseconds for everything to sync. Is that OK?
3) I use FireFox in my testing and was able to get a full XML file back. I am not sure why they wont go to 200. However readystate of 4 is all good, you are free to use the data because it is complete. Or officially: "The response is complete; you can get the server's response and use it." What status are you getting? Are you getting a 4xx response, or just no response?