Clarified todo, removed old commented-out JSONP code (now uses CORS)