Prevent XSS in JSONP callback

Replaces #103

See: http://stackoverflow.com/questions/2777021/do-i-need-to-sanitize-the-callback-parameter-from-a-jsonp-call