X-Content-Type-Options: nosniff on responses

[DemiMarie]

For security reasons, X-Content-Type-Options: nosniff should be set in HTTP responses.

This is a trivial patch, assuming that there is enough space in the output buffer.