always set x-content-type-options
actually verify the digest checksum