allowed_http_origins() only works in theme functions.php

Try using send_headers action hook instead of init. It should work.

add_action( 'send_headers', 'add_cors_http_header' );

function add_cors_http_header()
{
    header("Access-Control-Allow-Origin: *");
}