Use the correct Content-Type header for CAPTCHA

Some security inspection appliances and load balancers don't appreciate something in the HTTP headers that is not a valid HTTP header. Furthermore, the browser needs the Content-Type header to identify that the image is not the PHP default of text/html