Allow more granular control over JSONP

[daguej]

Currently, the ability to allow JSONP is a global app setting. There's no way to control whether a specific route allows JSONP other than deleting req.query.callback (or in 3.x, whatever you've set jsonp callback name to).

Consider an app that has routes where we want to allow public access (from other origins) and "private" APIs (routes that should not be accessible from other origins). We should be able to explicitly enable/disable JSONP, rather than the rather hacky method of globally enabling JSONP and then deleting query params to turn it off for specific routes. (This leaves the door open to forgetting to disable JSONP on a new, private route.)

[Radagaisus]

+1. Another approach is to create two servers, only one of them serves cross-domain requests, which sits nicely with rate limiting and monitoring.

[tj]

I'd prefer we go this route personally #1307 since res.json doesn't do much else