Fixed two major security holes.

There are two major security holes in the default jsonp.php file.  An attacker could easily fetch any file off the local server by simply passing in a filename into $_GET['report'] variable.  Second, an attacker could essentially send out and receive web requests on behalf of your server, since theres no validating of the hostname.  I've added the ability to whitelist a hostname in case anyone wants to lock their script down.