Security fix to prevent jsonp by default

The callback parameter in the request query string should not activate the jsonp format without checking the serializer.formats.