I think you have to add an Origin header, if you want so access with a self written app. Had a similar problem some time ago. Maybe the same applies here.
I repeated the tests.
Server: localhost
Client: localhost, Firefox with unmodified webextension from AMO
It fails with the unmodified code, with the well-known message (console).
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://localhost/owncloud/index.php/apps/notes/api/v0.2/notes?exclude=content . (Reason: CORS header ‘Access-Control-Allow-Origin’ missing).
But if you add the value of the origin value, in my case moz-extension://24e15b4…