Access-Control-Allow-Origin: *http header to all API methods. This allows cross domain requests using the
XMLHttpRequestobject in most browsers or
XDomainRequestobject in IE8.
Both approaches have their benefits and down sides, but I think the easiest approach would be to add the access control header. To show an example of the problem and potential solution I have setup a test page that should work with IE8, Firefox, Chrome, and Safari. The test page lets you try and download various files using the XMLHttpRequest or XDomainRequest objects and see how the same origin policy and access control header affects each of them. You can also use the web-sniffer.net site to check the HTTP headers for each requested URL.