I don’t think it’s a CORS problem, because it’s all the same domain. The server is just responding with a 403 error.
I had a look at your .htaccess file, and I think I see the issue. You’re having a section that specifically allows access to PHP files with specific names, and blocks everything else. However, the file name public_load.php is not in the allowed list, so the server blocks it.
Please consider renaming the file so it matches the allowed pattern, or updating the allowed pattern so it allows this file.