Add "X-Content-Type-Options: nosniff" header for IE8

This should help prevent IE8 from offering to download API payloads.

Fixes bug 2889.
Reviewed at http://reviews.reviewboard.org/r/4422/