add header Access-Control-Allow-Origin: * for XSS, standardize method of JSON delivery