prepend jsonp callbacks with a comment to prevent the rosetta-flash vulnerability

[background](http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/)

tl:dr - someone created a alphanum only swf converter, which means that they can in theory use it as a callback at a JSONP endpoint, and as a result, send data across domains.

Prepending callbacks with an empty inline comment breaks the flash parser, and prevents the issue. This is how google, facebook, github, et al are handeling it.

[CVE-2014-4671A](http://helpx.adobe.com/security/products/flash-player/apsb14-17.html)
That header can be added by setting

```javascript
{
  security: {
    noSniff: true
  }
}
```
in your server options.

Or with several other security related headers by just setting `{ security: true }`.

Just to remind people that this functionality does exist.