Setting remote-allow-origins sucks. If you set it to * I think that is very insecure. Selenium doesn't need this. The way to not have to set it is to not send the origin header.
// pass this to .connectToServer()
ClientEndpointConfig.Builder.create()
.configurator(
new ClientEndpointConfig.Configurator() {
@Override
public void beforeRequest(Map<String, List<String>> headers) {
headers.remove("Origin");
}
})
.build()