Switched from JSONP to normal XHR as endpoint now sets `Access-Control-Allow-Origin *`