return json w/ Allow-Origin in /wakeup