Great to know that
* is working, so we know that this is definitely the issue. I have tried to debug from here, however it seems the hosting site is behind a vpn so I cannot access any information about your headers.
The likely culprit is that for Access-Control-Allow-Origin you need
https:// in front of any domain you list. Allowing
https://vois.zeroheight.com should fix this when editing a styleguide, but we would also need
https://zeroheight.com allowed for this to work on your view-only styleguide.
As the Access-Control-Allow-Origin header only allows a single origin, you will need to implement origin checking (e.g. with a regex
^https:\/\/(vois\.)?zeroheight\.com$) and then update the header accordingly. An example can be seen for nginx here https://gist.github.com/slavafomin/b1edbdb352a6d9d6909a7f879e4ca7ea