Disable dynamic scripting

Given that ES has CORS enabled for *all hosts*, this is a nasty attack
vector. Let's turn it off.
Merge branch 'disable-scripting'