server allow jsonp, disable csrf protection
correcting server http-verbs to get (tests)
correcting server http-verbs to get