"the problem with JSONP: you're fully trusting the remote site with permission to execute arbitrary JavaScript on your page"