[Security] Make JSONP responses optional.

This poses a significant security threat by being on by default. If an attacker can entice a user to load a legitimate ElasticSearch query as a script tag, they can effectively bypass SOP and exfiltrate the contents of a local ElasticSearch instance (or bypass firewall rules by using a victim's browser to talk to a remote instance). 

This would be trivial to implement from an attackers perspective, and I'll be submitting a pull request to the BeEF project (https://github.com/beefproject/beef) to automate this sort of attack, as it'll be useful during a pentesting engagement. 

If you have any questions or change requests please let me know, and I'll be more than happy to accommodate. 

Thanks!
Fitblip
That's fair, but standards dictate that all JSONP responses should (at least in theory) return an application/javascript mime type. 

http://stackoverflow.com/questions/111302/best-content-type-to-serve-jsonp