only use json-p on non-cors browsers if not same origin