CORS is supported in most browsers today. Even IExplorer 8 has support for it. If you really want older browsers too, you can always fallback to flXHR.

yea all API calls are POSTs, the API server allows the static server to request.