[Security] Make JSONP responses optional.

This poses a significant security threat by being on by default. If an attacker can entice a user to load a legitimate ElasticSearch query as a script tag, they can effectively bypass SOP and exfiltrate the contents of a local ElasticSearch instance (or bypass firewall rules by using a victim's browser to talk to a remote instance). 

This would be trivial to implement from an attackers perspective, and I'll be submitting a pull request to the BeEF project (https://github.com/beefproject/beef) to automate this sort of attack, as it'll be useful during a pentesting engagement. 

If you have any questions or change requests please let me know, and I'll be more than happy to accommodate. 

Thanks!
Fitblip
if you do not supply the the content-type, you can just hand over the builder and do not need to create a string object here.

Also I would just return `JSON is disabled` instead of mentioning the config option here. The shorter the better IMO.