script src-ing the JSON document is pretty clever. It could be totally stopped by using a nonce in a header. You should already have implemented a nonce system

script src-ing the JSON document is pretty clever. It could be totally stopped by using a nonce in a header. You should already have implemented a nonce system for form submissions anyway.