This looks like it might have been requested before:
CORS is supported in all browsers but Opera. Firefox and Chrome have had support for quite some time now.
HTTP/1.1 200 OK Server: nginx/0.7.65 Date: Fri, 20 Jan 2012 02:06:16 GMT Content-Type: application/json; charset=utf-8 Connection: keep-alive Cache-Control: private Content-Encoding: gzip X-AspNetMvc-Version: 3.0 X-AspNet-Version: 4.0.30319 Content-Length: 4828
Contrast that with the Glitch API:
Access-Control-Allow-Credentials:false Access-Control-Allow-Methods:POST, GET, OPTIONS Access-Control-Allow-Origin:* Access-Control-Max-Age:1728000 Connection:keep-alive Content-Encoding:gzip Content-Length:317 Content-Type:text/plain; charset=utf-8 Date:Fri, 20 Jan 2012 02:07:15 GMT Server:Apache/2.2.17 Vary:Accept-Encoding
Access-Control-Allow-Origin is the important header here - it tells AJAX-enabled browsers whether or not they are allowed to access the content returned in the message.
Since this header effectively limits only AJAX-based API requests, the only security or performance issues would be related to whether or not it was "okay" for browsers to access the API methods directly via AJAX.