Use cross-origin-long-polling instead of JSONP

[deliminator]

I would like to avoid JSONP requests, mostly because of browser's loading indicator issues and security (no secrets in the query string).

Although cross-origin-long-polling is not a mandatory transport according to the bayeux spec, the spec is old, and CORS is widely supported. Would it make sense to either add it to the mandatory connection types, or to allow this to be enabled by introducing a new option?