It looks like you may not be using the right IP address for rpcallowip, to represent the source of the API requests as they appear to the node. Why not start with rpcallowip=0.0.0.0/0 to allow all incoming API requests, in order to confirm this is the problem? Also be sure to restart the node with each configuration change.