8.2 XSSI Defense

• JSON response by POST requests only.
• Don’t return an array or prefix your JSON response