Prepend JSONP response with empty comment to avoid CSRF

See http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/
Merge pull request #21 from hbz/jsonp-csrf

Prepend JSONP response with empty comment to avoid CSRF