Send X-Content-Type-Options:nosniff header for all responses

Changed CallHandler.cs to always add the X-Content-Type-Options:nosniff header.
Updated the VerifyOwinContext test to check for the header.