I'm having the same issue... but given that there are 15 domains, having the client access the admin cp from each domain isn't really an option.

Any resolution to this at all?

I was having the same issue... but given that there are 15 domains, having the client access the admin cp from each domain isn't really an option.

The key appears to be making sure that you have the following in both the admin cp domain and in the domain being previewed's .htaccess file:

Header set Access-Control-Allow-Origin "*"
Header set Access-Control-Allow-Headers "origin, x-requested-with, content-type"
Header set Access-Control-Allow-Methods "PUT, GET, POST, DELETE, OPTIONS"

...because you're setting there the origin is allowed. Caveat regarding overriding CORS apply.