sites: allow /api/urls to use jsonp