The browser is rejecting calls to the testrpc server because the header "Access-Control-Allow-Origin: *" is getting stripped off somewhere down the line. Seems nginx is doing this.
I worked around this by bypassing nginx:
testrpc.patch.txt
But maybe there is some tweak to the nginx conf file that will preserve the header?