JSON API: remove "wrapper" (may be insecure).