Support for XmlHttpRequest+CORS in addition to just plain jsonp.

We try XHR first, since it supposedly returns better error messages (not
always true).  Then fall back to jsonp if it doesn't work.