The service works flawlessly on the server it was created and tested on.  In fact, it works in IE9 when called from other servers. (All servers are in the same domain - in our intranet)

Chrome and Firefox are a different matter.  It doesn't work from any other service than the original.  I've added CORS headers... but it doesn't fix the problem.

In the Chrome console, I see the following error when calling it:

the server responded with a status of 403 (Forbidden)

Any ideas or suggestions?