REST API requests to WordPress.com via XMLHttpRequest (and CORS)