JSONP is a bad practice and can cause some pretty serious security side-effects.

XHRs historically cannot use 3XX redirects in Gecko. You need to use a non-3xx status code instead. The XHR *should* automatically follow the `Location` header to the redirected URL, but if it doesn't, your best bets are to either return a 203 and proxy the data that would otherwise come from the redirected URL, or to return a 204 with a `Location` or `X-Location` header, which you can then fetch. Even then, you'll need to have CORSed the API and added the `Location` header to the CORS header whitelist.