[FIX] JSON hijacking

Implements [ticket 1749](https://www.openproject.org/issues/1749)

Tested with [Firefox Portable 3.0.19](http://downloads.sourceforge.net/portableapps/FirefoxPortable_3.0.19_German.paf.exe?download) and the following HTML site (taken from [spiderlabs.com](http://blog.spiderlabs.com/2012/09/json-hijacking-demystified.html)) - don't forget to replace ``[IP:PORT]`` by the ip address and port number of your test system:

```html
<!doctype html>
<html>
  <head>
    <title>JSON Hijacking</title>

    <script type="text/javascript">
      var secrets = '';

      Object.prototype.__defineSetter__('project_type',function(obj){
        secrets = secrets.concat(" ", obj); 
      });
    </script>

    <script src="http://[IP:PORT]/api/v2/project_types.json"
      type="text/javascript"></script>

    <script type="text/javascript">

      var yourData = '';
      var i = -1;
      while(secrets && secrets[++i]) {
        yourData += secrets[i] + ' ';
      }

      alert('I stole your data: ' + yourData);
    </script>
  </head>
  <body>
    test
  </body>
</html>
```