Update links for comments about json list output.

The vulnerability in the older link affects only ancient browsers,
but there are other issues that are more recent.

Fixes #1009.