Instantiating classes using class and module attributes poses a security threat in case of untrusted JSON.

Let's follow-up to the discussion that started on reddit, regarding "add an argument to disable automatic package import".
I just sent a PR with a warning to the README.

Looking at the code in UniversalJSONDecoder, it's really trying to decode one way after another. So we could have a configuration telling exactly which methods we want enabled. It would be set in KajsonManager at init().

Also, we could have white lists:

• allowed sys.modules
• allowed dynamically imported modules
• allowed class names from the class registry

What do you think?