Ajax - "Access-Control-Allow-Origin" error in ember.js

I would like to know your opinion on the issue in this simple code in ajax, which has the problem Access-Control-Allow-Origin, already tried several ways defenir the ember "Access-Control-Allow-Origin": "* "but without success, so I wonder if someone with the same problem found a solution.

I use the url address 'localhost: 4200' and already tried with a subdomain of 'firebase' in both cases the error was always the same.

The ajax request:

import Ember from 'ember';
import { isAjaxError, isNotFoundError, isForbiddenError } from 'ember-ajax/errors';

export default Ember.Controller.extend({
ajax: Ember.inject.service(),
actions: {

 code() {

        var cliente = '***';
        var redirectUri = 'http://localhost:4200/teste';
        var client_secret = '***';
        var code = '***';
        var grant_type = 'authorization_code';
        var data =
            "client_id=" + cliente +
            "&redirect_uri=" + encodeURIComponent(redirectUri) +
            "&client_secret=" + client_secret +
            "&code=" + code +
            "&grant_type=" + grant_type;

        this.send('post', data)

    },

    post(data) {

        this.get('ajax').post("http://ift.tt/1cWYSBC", {
            method: 'POST',
            headers: {
                "Access-Control-Allow-Origin": "*",
                "Content-Type": "application/x-www-form-urlencoded",
            },
            data: data,
            dataType: 'JSON',

        });
      }, 
   }});`

My content Security Policy:

contentSecurityPolicy: {
        'connect-src': "'self' http://localhost:4200 http://ift.tt/1ymbsZQ http://ift.tt/1cWYSBC",
        'child-src': "'self' http://localhost:4200",
        'script-src': "'self' 'unsafe-eval' https://login.live.com",
        'img-src': "'self' http://ift.tt/2bqnwQj http://ift.tt/2bn4gGK http://ift.tt/1ASonEP http://ift.tt/11DnTic https://www.gstatic.com",
        'style-src': "'self' 'unsafe-inline' ",
    },

The error is:

XMLHttpRequest cannot load http://ift.tt/1cWYSBC. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:4200' is therefore not allowed access.