This is the problem I see with the cross-domain requests; it puts the implementation change on the service provider rather than the app provider. If I was building an application using PHP I don't need to get twitter to change their server to allow me call their apis, so why is this different.