CORS and modifying the response header
<p>I understand that for site A to make a request to site B, site B must specify in it's header response that site A is allowed access by <code>Access-Control-Allow-Origin: http://siteA.com</code>
Also  <a href="http://www.html5rocks.com/en/tutorials/file/xhr2/#toc-cors" rel="nofollow">this</a> site states that </p>

<blockquote>
  <p>Enabling cross-origin requests is easy, so please, please, please
  enable CORS if your data is public!</p>
</blockquote>

<p>which makes sense to me.</p>

<p>My question is that even if my site B has NOT specified the <code>Access-Control-Allow-Origin</code> header for site A, I can still gain access to the data through client side JS on site A by using a Chrome plugin or disable web security. This doesn't make sense.  <strong>How can the client modify the servers response headers and site A still get access to the data through JS?</strong></p>

<p>Btw site A in this case is <code>localhost:9000</code> if that matters.</p>