Implement API non-RESTful format, JSONP, CORS

Fixes #53.
Minor: Are we planning to send back plaintext errors long-term? If not, maybe add a `TODO`.