improve MIME type handling somewhat

* Avoid Flask implicit guess/default of `text/html` for what's often plaintext content; now defaults to `application/octet-stream` instead
* Serve actual HTML as `text/plain` sourcecode instead of having the browser try to render it. Since a `.html` file is often a template and almost always depends on other files in the repo, it will seldom render properly anyway.
* Takes a stab at some level of security regarding untrusted Web content

I am extremely open to feedback on this PR.