Send X-Content-Type-Options header to Chrome users as well (not just IE) and improve tests

* Chrome supports the X-Content-Type-Options header for a few use cases
  (including not processing JavaScript for text/plain content types), so
  send the X-Content-Type-Options header to Chrome users (fixes #53).
* Clean up HSTS tests to better match other header tests.
* Test X-XSS-Protection header on all browsers.
* Test X-Content-Type-Options header on both IE and Chrome.