Strip XSSI prefix from JSON response (fixes #251)