Disable dynamic scripting

Given that ES has CORS enabled for *all hosts*, this is a nasty attack
vector. Let's turn it off.
Merge branch 'disable-scripting'
Update elasticsearch to 1.1.1
Fix failling spec due to the elasticsearch formula update
Merge pull request #13 from Ledej/update-elasticsearch

Update elasticsearch to 1.1.1
Upgrade to ES 1.2.1