Serve js ourself because of new nosniff policy