The callback parameter may be an XSS vector
I found an answer on stackoverflow that filters the JSONP callback response. This is needed because the callback parameter can be manipulated into a XSS attack that steals CSRF tokens like this:
UTF7 injections are possible if charset isn't included
If the header is not
Content-Type Selection may have an impact
Content type does affect the HTTP based compression of certain shared web hosts.
There is some functionality difference between what can be done in some browsers based on the Content-Type. I'll have to dig up the links from StackOverflow