disable dynamic scripts by default.
added comment about why this setting exists.
Merge pull request #2 from bcoe/security-fix

Remote Execution Security Fix