Adds CORS support

##### Summary

- Adds a configuration parameter to shift all requests to use JSON+CORS via xhr instead of jsonp
- Removes caching scaffold
- Updates fixture server to handle POST requests
- Adds tests for plan & token

##### TODO

- cross-browser test

cc @bhelx @austinheap @cbarton @drewish 
Double check to make sure this data is safe for url