The callback value [ought to be tested for potential XSS attacks](http://www.metaltoad.com/blog/using-jsonp-safely) by checking to see that it only contains `[\w]+`.