Adds CORS support

##### Summary

- shifts all requests to use JSON+CORS via xhr instead of jsonp
- also removes caching scaffold

##### TODO

- cross-browser test

cc @bhelx @austinheap @cbarton @drewish 
Here's the meat of things. We're using a pretty bog-standard xhr here. If it's a `GET` request, the payload is pushed onto the url and nulled out. in the case of a `POST`, we set the appropriate Content-type and send the payload along unmodified.