Remember that the browser is connecting to the graylog2-server instance directly and needs access to it. You also need to enable CORS in your graylog2-server.conf.