Yeah, it's only possible on the same hostname as the page you're on, which limits the usefulness and makes the server-side lookup necessary. The JSON solution will only work via a foreign host with a <script> tag as far as I know, which again is something of a trust issue.