I have a managed VF page with header="true" and sidebar="false" that occasionally shows this in the JS console, and never seems to show the session timeout popup window that generally occurs.
XMLHttpRequest cannot load https://na12.salesforce.com/_nc_external/system/security/session/SessionTimeServlet?buster=1425614285835. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://mahnamespace.na12.visual.force.com' is therefore not allowed access.
Does anyone know of a workaround to get this method working using a relative url? I assume this fix would also get the session timeout popup window working again. I currently have none and am aware of no VF config around this feature.