don't use jquery .getJSON cause that "helpfully" enables JSONP which is a security vulnerability here, closes #41