Cross Domain Scripting (yes another one!)

Hi everybody,

I have written a silly Christmas game with a high score table. The game is at http://tig0r.com/sendsantapacking.

From here the high-score table works fine.

I've published the game to the Scirra arcade https://www.scirra.com/arcade/action-games/send-santa-packing-13497). However... the high-score table doesn't work (which of course I also found whilst testing on localhost and had to upload the game to the website for it to work).

So... of course I need to enable cross domain scripting.

Ideally I imagine I want to add this to the top of my .php file -

<?

header('Access-Control-Allow-Origin: https://www.scirra.com');

..

...which doesn't work. Worse still I can't even make this work!!

<?

header('Access-Control-Allow-Origin: *');

..

I've read about a billion articles and they all say the same thing.

So what am I missing?!!

Server is Apache.

Many thanks to anybody who can tell me what I've got wrong here! <img src="{SMILIES_PATH}/icon_e_smile.gif" alt=":)" title="Smile">