If you want to make an AJAX call to get, say, some JSON from eXist you'll need to allow it (because of the CORS thing).
You can add a stanza to Jetty's web.xml file ($exist-home-dir/webapp/WEB-INF/web.xml) like this:

    <filter>
        <filter-name>cross-origin</filter-name>
        <filter-class>org.eclipse.jetty.servlets.CrossOriginFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>cross-origin</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

which will allow all external requests. Probably not what you want in production, but you can fiddle the url-pattern to suit.