CSRF protection from cross-origin <script> tags.

TODO: Update Security guide to discuss GET .js from third-party <script>

Thanks to @homakov for sounding the alarm about JSONP-style data leaking
via cross-origin JavaScript response embedding.