2.20.0 result.headers.get('x-content-type-options') does not return header

Summary.

## Expected Result

What you expected. (as seen with downgrading to 2.19.1)

```
Successfully installed requests-2.19.1 urllib3-1.23
(pytest-env) ./test_send_request.py
-> assert result.headers.get('x-content-type-options') == 'nosniff', \
(Pdb) result.headers
{'Server': 'nginx', 'Date': 'Sat, 27 Oct 2018 08:22:52 GMT', 'Content-Type': 'application/json', 'Content-Length': '675', 'Connection': 'keep-alive', 'Set-Cookie': 'redacted; HttpOnly; Path=/', 'Strict-Transport-Security': 'max-age=63072000; includeSubDomains; preload', 'X-Content-Type-Options': 'nosniff', 'X-Frame-Options': 'DENY', 'X-XSS-Protection': '1; mode=block', 'Referrer-Policy': 'same-origin'}
```

## Actual Result (2.20.0)

```
-> assert result.headers.get('x-content-type-options') == 'nosniff', \
(Pdb) result.headers.get('x-content-type-options') <--- no header returned
(Pdb) result.headers
{'Date': 'Sat, 27 Oct 2018 08:04:06 GMT', 'Content-Type': 'text/html; charset=utf-8', 'Transfer-Encoding': 'chunked', 'Connection': 'keep-alive', 'Vary': 'Accept-Encoding', Max-Age=864000000; Path=/usernamepassword/login; HttpOnly; Secure', 'X-Robots-Tag': 'noindex, nofollow, noindex, nofollow, nosnippet, noarchive', 'Cache-Control': 'private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0', 'Strict-Transport-Security': 'max-age=15724800', 'Content-Encoding': 'gzip'}
```

What happened instead.

## Reproduction Steps

```python
import requests

```

## System Information

    $ python3 -m requests.help

```
python3 -m requests.help
{
  "chardet": {
    "version": "3.0.4"
  },
  "cryptography": {
    "version": ""
  },
  "idna": {
    "version": "2.7"
  },
  "implementation": {
    "name": "CPython",
    "version": "3.6.5"
  },
  "platform": {
    "release": "17.7.0",
    "system": "Darwin"
  },
  "pyOpenSSL": {
    "openssl_version": "",
    "version": null
  },
  "requests": {
    "version": "2.20.0"
  },
  "system_ssl": {
    "version": "100020ff"
  },
  "urllib3": {
    "version": "1.23"
  },
  "using_pyopenssl": false
}
```

We need far more information than is provided here to help you. In all honesty, though, I severely doubt this is a bug in Requests. For example, 

- What URL are you requesting?
- Can you share the test code that is failing?
- Are there redirects involved?
   - Have you checked the redirects to see what's happening?

@sigmavirus24 

I have nginx config that is configured like so:

```
    location / {
      proxy_pass http://my_api;

      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto https;
      proxy_set_header Host $http_host;
      proxy_redirect   off;

      add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
      add_header X-Content-Type-Options    "nosniff"       always;
      add_header X-Frame-Options           "DENY"          always;
      add_header X-XSS-Protection          "1; mode=block" always;
      add_header Referrer-Policy           "same-origin"   always;
    }
```

And with 2.19.1 we get these headers back, which has been checked and passing in our CI-pipeline for ages. But now I looked again I see `Strict-Transport-Security` value is off as well. From my point of view the only thing that changed was the requests version (literally swapping between the two in the same virtual env and calling the endpoint).

I'll have to do some more digging to see what is going on.


@sigmavirus24 

After some further analysis we did uncover one endpoint that was doing a bad redirect. It was redirecting to http, which was then again upgraded by nginx but without `X-Content-Type-Options` in the response headers.

We don't think that STS headers are being honoured by `requests` and if we confirm this will look at creating an enhancement request.

Closing this issue then.