I see what you are saying, the one endpoint is the avatar url so this isn't protected by Same Origin Policy anyway.  The other end point; however, is a super trimmed down json endpoint that has a few generic pieces of information about the user from the person db and it already requires you to know something about the user to get to the data.  I will have to think a little more on what to do with this.  I was trying to avoid hard coded origins in this config, and this filter plugin seems to only support subdomains not wildcards in urls.  I will have to dig some more.

Thanks for the comment.