If it's client side, what about CORS and ACL?

Transifex CDS already supports CORS and authenticates using a public project token. We are already using that in Transifex explore pages and the JS SDK, where translations are retrieved through Ajax calls (read-only access).