Fix JSONP resources

Completes #2562. Closes #2560.

This PR doesn't add tests for each endpoint, because that would be bloating the test suite. The proper fix is to factor the code so that CORS/JSONP works for all JSON endpoints.