[simonw]

CORS will not protect you against CSRF - in fact, if you don't apply it with caution it will open you up to CSRF attacks.

[Sir_Cmpwn]

Sorry, I wasn't necessarily saying that CORS will save you, but more suggesting that there's no reason to use JSONP.