JS: Handle default 'content-type' header in Response() objects

[asgerf]

When using new Response() to construct HTTP responses, the content-type header defaults to text/plain;charset=utf-8 unless explicitly set to something else.

This means its argument is not an html-injection sink when the header is omitted.