model: CORS-friendly Backbone.sync