Replace JSONP with CORS

[konklone]

As recommended in WhiteHouse/api-standards#14, and by others, CORS is a far superior replacement for JSONP.

CORS is not supported on some older browsers, but unless XHR (Ajax) support in IE8 and below is a priority for the API, there are good reasons (complexity, security) to avoid adding it altogether. In other words, no JSONP without good reason, and CORS defaulting to on.

[NoahKunin]

I'd go even farther w/JSONP. IE 9 and below should not be supported - full stop. We do no one any favors by allowing them to use flawed browsers.

[konklone]

This is a good reminder that this is an expression of what we do more than saying what everyone else should do. 👍 to that, feel free to make the edit if you like.

[NoahKunin]

IE8 if fully EOL'd, so I'll definitely make that edit at min.