Unicode escapes must be scalar values

Code points was not precise enough.

Explicitly disallow the JSON UTF-16 surrogate hack which would cause portability issues.

(Something Python 3 should have done, incidentally; as of Python 3.4 you can build strings that can't be printed to a UTF-8 stream)