I think you have to add it into "OnAuthentication" step or add config into your web config. You can try my code :) it works
public class AllowCrossSiteJsonAttribute : ActionFilterAttribute, IAuthorizationFilter
{
public void OnAuthorization(AuthorizationContext filterContext)
{
filterContext.RequestContext.HttpContext.Response.AddHeader("Access-Control-Allow-Origin", "*");
}
}