Address CVE-2014-4671 (JSONP Flash exploit)

Adds a comment before JSONP callbacks. See
[the reporter's blog post](http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/) and [the CVE](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-4671) for more information on the vulnerability.