prepend jsonp callbacks with a comment to prevent the rosetta-flash vulnerability

[background](http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/)

tl:dr - someone created a alphanum only swf converter, which means that they can in theory use it as a callback at a JSONP endpoint, and as a result, send data across domains.

Prepending callbacks with an empty inline comment breaks the flash parser, and prevents the issue. This is how google, facebook, github, et al are handeling it.

[CVE-2014-4671A](http://helpx.adobe.com/security/products/flash-player/apsb14-17.html)
For a while I think @hueniverse was debating enabling all of the security headers by default. I'm not sure how he feels about this.