Probably not actual anymore, but would be useful for someone else maybe. The thing is you are not sending GET request as required by Trademe API, but as you add custom headers (in Trademe case you probably send oAuth header) to a potential GET request, browser sends another what's called "preflight request" which is OPTIONS request, as per your screenshot you can see Method is OPTIONS. And ideally Trademe should correctly respond back on that to allow the GET request with custom headers itself. Probably it's not happening because of a security measures. By the way you shouldn't send Auth keys/secrets from the client browser app anyway as it's exposed. It was a bit annoying for me too as I wanted to do a quick test from a client js app without proxying to a backend, but to solve this one of the solutions (which worked for me) was using a "backend" proxy call. So your browser app calls say some node/php script which does a Trademe API call and returns the result to the browser.
More about CORS and preflight requests:
http://www.html5rocks.com/en/tutorials/cors/#toc-types-of-cors-requests