make json-p wrapping an option, and have it do cors also