I feel like the browser could use the Content-Type header to check whether the response is JSON or actual executable javascript - throwing an error if the former