Is there currently support for adding the "Access-Control-Allow-Origin" header to the REST API requests? Nearly all modern browsers are set to block those sorts of requests without that header.
(Obviously this is ignoring JSONP, which has its share of security concerns.)