prepend jsonp callbacks with a comment to prevent the rosetta-flash vulnerability

[background](http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/)

tl:dr - someone created a alphanum only swf converter, which means that they can in theory use it as a callback at a JSONP endpoint, and as a result, send data across domains.

Prepending callbacks with an empty inline comment breaks the flash parser, and prevents the issue. This is how google, facebook, github, et al are handeling it.

[CVE-2014-4671A](http://helpx.adobe.com/security/products/flash-player/apsb14-17.html)
JSON-P responses should also get an `X-Content-Type-Options: nosniff` header, just in case. (This would have prevented the Rosetta Flash vulnerability too, in modern browsers, and it might prevent similar attacks that bypass the `/**/`-based protection in the future.)

See <https://gist.github.com/mathiasbynens/5547352> for an example in PHP (LOLWAT, I know).