Opt-In JSON security

This makes the JSON security check more reliable and adds a
configuration option that allows you to disable it if you aren't
targeting old browsers.