v2 REST API Tweaks

* Security fix for potential JSONP flash attack
* JSONP content-type fix
* Order status endpoint
* Field restriction for newly-added v2 endpoints
* other misc tweaks