Hello OP,
I reproduced the issue on my environment, and I was also seeing the 403 error response after adding the prototypeJS script tags to my web page.
You are likely seeing the 403 error message due to the
CORS policy. For security reasons, modern browsers (e.g chrome, Mozilla, etc) do not allow “cross-domains” requests, notably Ajax request due to this policy. CORS defines a way in which a browser and server can interact to determine whether it is safe to allow the cross-origin request.
Based on the information you have provided, I performed a bit of research for you, and found this
StackOverflow answer to the CORS issue. From the post, you can set the HTTP header: "Access-Control-Allow-Origin" with value of "*" or "your client domain". You can either send this header from the Extensible Serviceable Proxy (ESP) which is part of the Google Cloud Endpoint, or you can send the HTTP header from your server side API script.
Hope this helps.