[SalesForce] Default Lead Source (or any standard hidden field) on Web-to-Lead form

You are hitting the browser's same origin security policy. This means that your JavaScript can only make AJAX calls back to the same origin of the containing page - in this case http://domainname.ext. You are trying to make an AJAX call to Salesforce and that gets blocked.

CORS (cross origin resource sharing) relaxes this restriction by letting servers define which origins are allowed to call them through HTTP headers such as Access-Control-Allow-Origin. However, this is configured on the target server (www.salesforce.com) so Salesforce would need to provide these headers in response to your request, and they don't. Thus your request doesn't succeed and the browser gives you the error.

What is a little confusing about CORS is that you make a request to the server and it will respond with headers to indicate whether the request was allowed or not. The browser then tells you that you can't access that server, but it didn't know until you tried!

Update: See Use CORS to Access Supported Salesforce APIs, Apex REST, and Lightning Out

Here's my hunch:

If we go thru the order of execution of triggers it mentions running the assignment rules after both the after and before triggers have finished running, which implies owner field will be changed again when the assignment rules fire. And here's another link which explains how the leads are assigned when it is generated from web-to-lead. It says that if the assignment rule fail to locate an owner (in your case there are no assignment rule) then the lead will be assigned to the default owner as mentioned in the setting or If you do not use assignment rules, all web leads will be assigned to the Default Lead Creator.

Setting the owner in a future method should do the trick as that will be considered another transaction.