Step to reproduce in development environment:

• go to Tasklist
• click the "Start porcess" button in the header
• Search for "Invoice Receipt"
• Click the (only) link
• Bähm.. you should see "Form failure: Origin is not allowed by Access-Control-Allow-Origin"

Expected behavior:
A form shows up in the modal dialog (for business key and variables) and the process can be started.

Note:

• Somehow strange error, because actually, this is not a cross origin request.
  From the Chrome developer tools:
  Request URL: http://localhost:8080/camunda/api/engine/engine/default/process-definition/invoice:4:8ac4fdde-da07-11e5-b796-4232b4c10733/startForm
  Referer: http://localhost:8080/camunda/app/tasklist/default/
  No preflight request is performed
• Probably not relevant.. but.. I redeployed the process definition a few times (version 4, as you can see in the Request URL above) before trying to start it
• The issue is very likely in camunda-bpm-sdk-js (as it is used to perform the requests)