Also, if I take the iframe url of the app and navigate to it in a browser tab, the same code works.  Seems like it's some kind of IE cross domain security thing.

I have a very simple little widget in my app that gets loaded via ajax in makeRequest. There's a js object with some url params, and a script that's linked to on a separate domain from the app itself that contains the methods to do an ajax request and a callback function. In firefox, everything works fine, but in IE it does not... it ...