Labs, or at least Tools Labs, should be added to the CORS list. That would allow, amongst other things, for the retrieval of cached Wikidata objects, like this:
(which redirects to https://www.wikidata.org/wiki/Special:EntityData/Q12345.json )
This would reduce the load on the servers, and speed up the access to Wikidata objects (unless done in huge numbers).
I would prefer CORS to be enabled for all of the Wikimediaverse, not just the Wikidata URL(s), for a few other tools.
According to bug #60835 Labs should be added to $wgCrossSiteAJAXdomains, apparently.