Yeah, I would say go with CORS. Then, the UI can just do a GET with some query params and then the server can spit back the zip.

This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira