Embedded AJAX responses aren't application/json, but application/vnd.drupal-ajax

Fabianx told me in chat:

We would need to check the CSP policies on that. application/json is explicitly allowed.

I am less sure about another content type. If that is not blacklisted by browsers, sure go ahead :).

So, let me investigate that.

I investigated #2510104: Convert drupalSettings from JavaScript to JSON, to allow for CSP in the future and why it went with <script type="application/json">…</script>. It was based entirely on https://mathiasbynens.be/notes/json-dom-csp#script, which explicitly says: Alternative: an inline <script> element with a non-JavaScript type

In the comments on that blog post, Nicolas Gallagher from Twitter says:

FWIW, we use the script-with-different-type approach for Twitter Cards (Neil Matatall works at Twitter too).

And, sure enough:

<div class="TwitterCardsGrid TwitterCard" data-impression-id="5e16b220ea4bd197" data-earned="false">

  <script type="text/twitter-cards-serialization">
    {
      "strings": { },
      "card": {
  "viewer_id" : "14637504",
  "forward" : "true",
  "publisher_id" : "16742099",
  "is_logged_in" : true,
  "is_author" : false,
  "language" : "en",
  "card_name" : "promo_website",
  "token" : "57b6487a7545560c0b5d3d54105473018aa85956",
  "card_uri" : "https://t.co/wLPXaLnytX",
  "tweet_id" : "699205127303921665",
  "card_url" : "http://go.qlik.com/BLX_2016_H1_Virtual_Forum_PRG_Infographics.html?sourceID1=P_Twitter"
},
      "scribeData": {
        "card_name": "promo_website",
        "card_url": "http://go.qlik.com/BLX_2016_H1_Virtual_Forum_PRG_Infographics.html?sourceID1=P_Twitter"
        
        , "publisher_id": "16742099"
        
      }
    }
  </script>


  <div class="TwitterCardsGrid-col--12 TwitterCardsGrid-col--spacerBottom CardContent">
    <a class=" js-openLink u-block TwitterCardsGrid-col--12 TwitterCard-container TwitterCard-container--clickable SummaryCard--large" href="http://go.qlik.com/BLX_2016_H1_Virtual_Forum_PRG_Infographics.html?sourceID1=P_Twitter" data-impression-id="5e16b220ea4bd197" data-card-breakpoints="w500 w450 w400 w350 w300 w250 w200 w150 w100 w50 ">
  <div class="SummaryCard-image TwitterCardsGrid-col--12">
    <div class="tcu-imageContainer tcu-imageAspect--5to2">
  <style>
    .tcu-image-699205127303921665 {
background-image: url(https://pbs.twimg.com/media-preview/699205070618017792/G-endPOR.png) !important;
            
    }
  </style>
  <div class="tcu-imageWrapper tcu-image-699205127303921665">
    <img class="u-block" src="https://pbs.twimg.com/media-preview/699205070618017792/G-endPOR.png" alt="">
  </div>
</div>

  </div>
  <div class="SummaryCard-contentContainer TwitterCardsGrid-col--12">
    <div class="SummaryCard-content">
  
  <h2 class="TwitterCard-title js-cardClick tcu-textEllipse--multiline">Find out in the Qlik Virtual Forum 2016 infographic. View now.</h2>

  
  <span class="u-block TwitterCardsGrid-col--spacerTop SummaryCard-destination">go.qlik.com</span>

</div>
  </div>
</a>

  </div>


</div>

Conclusion: it's safe to proceed with this.

Fix typos.

Small clean-up/consistency.

Bumping to major. We should ship Drupal 8.1 with BigPipe like this ASAP, because it's The Right Thing.

Straight reroll.

Also committed & pushed to the contrib module for Drupal 8.0: http://drupalcode.org/project/big_pipe.git/commit/1df7881