For cross domain I just found this
enable cross-origin resource sharing
https://manning-content.s3.amazonaws.../CORS_ch01.pdf
This is interesting.
It's OK for free content because your API Key is in plaintext in the .js file -- Facebook and the like ... You could also watermark your public images and make them available for wide distribution.