<httpProtocol>
  <customHeaders>
    <!-- <add name="Access-Control-Allow-Origin" value="*" /> -->
    <add name="Access-Control-Allow-Headers" value="X-AspNet-Version,X-Powered-By,Date,Server,Accept,Accept-Encoding,Accept-Language,Cache-Control,Connection,Content-Length,Content-Type,Host,Origin,Pragma,Referer,User-Agent" />
    <add name="Access-Control-Allow-Methods" value="GET,POST,PUT,DELETE,OPTIONS" />
    <add name="Access-Control-Allow-Credentials" value="true" />
  </customHeaders>
</httpProtocol>

public override void OnActionExecuted(System.Web.Http.Filters.HttpActionExecutedContext context)
    {
        if (context.Exception != null) // hndle exception your self
        {
            Debug.WriteLineIf(PassPlayEnvironment.AuthenitcationSwitch.TraceInfo,
                string.Format("{0}: OnActionExecuted exception: {1}", Thread.CurrentThread.ManagedThreadId, context.Exception.Message));

            // handle/format exception
            context.Response = HandleException(context.Exception, context.ActionContext.ActionArguments);
        }
        else
        {
            Debug.WriteLineIf(PassPlayEnvironment.AuthenitcationSwitch.TraceInfo,
                string.Format("{0}: OnActionExecuted: {1} Time: {2}", Thread.CurrentThread.ManagedThreadId,context.Response.StatusCode, this.auditData.ElapsedTime));

            // log what happened
            auditData.WriteLog();

            if (context.Request.Headers.Referrer != null)
            {
                string corsValue = context.Request.Headers.Referrer.GetLeftPart(UriPartial.Authority);
                context.Response.Headers.Remove("Access-Control-Allow-Origin");
                context.Response.Headers.Add("Access-Control-Allow-Origin", corsValue);
            }
            // return data
            base.OnActionExecuted(context);
        }
    }

var xmlhttp = new XMLHttpRequest();
xmlhttp.withCredentials = true;
xmlhttp.open("GET", “ntlm_xxxxyyy.uuu/login”, true);
xmlhttp.send();
xmlhttp.onreadystatechange = function () {}