Resolved this on IRC; the MediaWiki API has a weid non-standard format (for caching reasons, I assume), where the Origin header has to be repeated in the URL.