Adds CORS support

##### Summary

- Adds a configuration parameter to shift all requests to use JSON+CORS via xhr instead of jsonp
- Removes caching scaffold
- Updates fixture server to handle POST requests
- Adds tests for plan, tax, & token

cc @bhelx @austinheap @cbarton @drewish 
It is XDomainRequest which needs these CORS headers, even if the request is same-domain. The assumption is fair, given the name.