Don't return valid JavaScript from action.php

This avoids an attack where a malicious webpage contains

  <script id="data" type="application/json"
    src="http://play.pokemonshowdown.com/~~showdown/action.php?act=upkeep"/>

The webpage could then read the value of the `data` element using
standard DOM methods in order to steal the user's login assertion
and login as the user on the `showdown` server.