Use rack-contrib's jsonp middleware. It works well with rack-protection and keeps it from freaking out.