http - CORS - why is the following example of a cross origin request allowed? -

given following request headers:

** general request url:http://0.1.2.3:4040/path/to/image.png   request method:get   status code:200 ok   remote address:0.1.2.3:4040  ** request headers accept:image/webp,image/*,*/*;q=0.8 accept-encoding:gzip, deflate, sdch accept-language:en,en-us;q=0.8 cache-control:no-cache connection:keep-alive cookie:jsessionid=4iszpyyzk50qa07h4fez8g20 host:10.2.2.23:4040 pragma:no-cache referer:http://localhost:3000/?mandator=xyz user-agent:mozilla/5.0 (macintosh; intel mac os x 10_11_5) applewebkit/537.36 (khtml, gecko) chrome/51.0.2704.103 safari/537.36 

how come browser allows response without 'access-control-allow-origin' header, , doesn't throw cors exception?

** response headers http/1.1 200 ok server: nginx/1.4.6 (ubuntu) date: wed, 06 jul 2016 09:36:14 gmt content-type: image/png transfer-encoding: chunked connection: keep-alive expires: sun, 22 jan 2017 09:36:14 gmt 

update: origin of request localhost:3000