Normally, there are provisions in the gevent-socketio to send the CORS headers for cross-domain requests.. sometimes, if there is a crash somewhere in the request, the framework replies with an empty (no CORS headers) Not Found, or Bad Request or something like that. In that case, the front-end sees that reply as not authorizing CORS requests.. but really it's just an error.
When using cross-origin requests, I try to send my errors back with Access-Control headers set.. so at least the error messages are complete and useful on the front-end.
Hope this gives you some clues
Alexandre