- handles json/jsonp transparently (avoiding code duplication in templates)
- use php's internal json_encode functions (with JSON_UNESCAPED_UNICODE
for backward compatibility)
- be more liberal with what is allowed as a callback identifier
- return a 400 for illegal callbacks
- return application/javascript type when jsonp is requested
fixes#16, fixes#17