[Security] Make JSONP responses optional.

This poses a significant security threat by being on by default. If an attacker can entice a user to load a legitimate ElasticSearch query as a script tag, they can effectively bypass SOP and exfiltrate the contents of a local ElasticSearch instance (or bypass firewall rules by using a victim's browser to talk to a remote instance). 

This would be trivial to implement from an attackers perspective, and I'll be submitting a pull request to the BeEF project (https://github.com/beefproject/beef) to automate this sort of attack, as it'll be useful during a pentesting engagement. 

If you have any questions or change requests please let me know, and I'll be more than happy to accommodate. 

Thanks!
Fitblip
Awesome! I didn't realize that was there. The original jsonp handling code used this mechanism, so I figured it was the best way. As an aside - are there any good ways to discover this with java, or is it pretty much you find it on a whim/go digging through the code?