Create preference to disable jar:
iSec suggested we create a preference to disable JAR and provided a patch: https://github.com/iSECPartners/publications/blob/master/reports/Tor%20Browser%20Bundle/artifacts/network.jar.block-remote-files.patch
They recommended we set this at "Low" (ie by default). I would be more comfortable setting it at one of the Medium settings, I think.