Add some security enhancements

* Make JSONP support configurable
* Add CORS config options