Due to Javascript security rules, you are not allowed to make an XMLHttpRequest to another server. Even two servers running on the same machine, but different ports have this limitation.
What you need to do, is to have a cgi proxy on your tomcat webserver, and use the OpenLayers.ProxyHost to point to it.
The OpenLayers site has a FAQ Answer for this issue :
Why do I need a ProxyHost?
Due to security restrictions in Javascript, it is not possible to
retrieve information from remote domains via an XMLHttpRequest.
Classes like WFS and GeoRSS use XMLHTTPRequest to get their data. If
they are querying a remote server (anything other than the machine
hosting your page), you must install a proxy script somewhere web
accessible on that machine. See below for how to set up your own
ProxyHost.
If the OpenLayers.ProxyHost variable is not set to a valid proxy host,
requests are sent directly to the remote servers. In most cases, the
result will be a security exception, although this exception often
occurs silently. How do I set up a ProxyHost?
An example proxy host script is available here:
trunk/openlayers/examples/proxy.cgi
For the standard Apache configuration, you would place proxy.cgi into
your /usr/lib/cgi-bin/ directory.
Once a proxy host script has been installed, you must then edit the
OpenLayers.ProxyHost variable to match that URL.
Given the above standard Apache configuration:
OpenLayers.ProxyHost = "/cgi-bin/proxy.cgi?url=";
If you have done something like this, you should be able to visit:
http://YourDomain.example.com/cgi-bin/proxy.cgi
The resulting content at that page should be the openlayers.org
website.
If you get a 404 error instead, either the proxy script is not in the
right location, or your webserver is not configured correctly.
After you have copied over the proxy file to your server, don't forget to edit the allowedHosts array.