xss is enabled for api call, no need for jsonp