devel/ipython -- remote execution

Kyle Kelley reports:

Summary: JSON error responses from the IPython notebook REST API
contained URL parameters and were incorrectly reported as text/html
instead of application/json. The error messages included some of these
URL params, resulting in a cross site scripting attack. This affects
users on Mozilla Firefox but not Chromium/Google Chrome.
API paths with issues:

/api/contents (3.0-3.1)
/api/notebooks (2.0-2.4, 3.0-3.1)