First, the standard Connect install uses Tomcat, not Jetty. (Unless you've chosen to run CPS on Jetty.) But I think the CrossOriginFilter works in Tomcat as well.
Why the extra slash in the url-pattern? Wouldn't you want:
<url-pattern>/*</url-pattern>
Is there any trace of your request in the container or CPS logs?