Adds CORS support

##### Summary

- Adds a configuration parameter to shift all requests to use JSON+CORS via xhr instead of jsonp
- Removes caching scaffold
- Updates fixture server to handle POST requests
- Adds tests for plan & token

##### TODO

- cross-browser test

cc @bhelx @austinheap @cbarton @drewish 
Maybe you could also check the return of `request(...)` somewhere. Not sure if you do.