Looks like even though elastic-search supports CORS, kibana does not and there doesn't appear to be any handling for Options requests.
The only solution I came up with for my requirements was to introduce a web-proxy in front of kibana, so that kibana and my other services were running in the same domain. For that I used nginx and the steps documented at