Should we be concerned that returning JSON lists could be a potential security problem? We try to return only JSON objects everywhere I thought. This doesn't say why: https://www.owasp.org/index.php/OWASP_AJAX_Security_Guidelines#Always_return_JSON_with_an_Object_on_the_outside but it has to do with javascript being able to replace the native Array type in some implementations.