Preventing JSON hijacking

[faassen]

See here:

https://stackoverflow.com/questions/2669690/why-does-google-prepend-while1-to-their-json-responses?rq=1

A way to globally replace the render_json behavior would be useful. Perhaps render_json needs to be looked up in the registry....