Set X-Content-Type-Options "nosniff" header.
Merge remote-tracking branch 'upstream/master'