additionally block Content-Type to avoid MHTML XSS