// create file cors.json, containing:
[
  {
    "origin": ["http://origin1.example.com"], // or ["*"] to allow all
    "responseHeader": ["Content-Type"],
    "method": ["GET"],
    "maxAgeSeconds": 3600
  }
]// then
$ gsutil cors set ./cors.json gs://...