Fix primary detection logic when content-type is missing

If an IdP doesn't expose the content-type header, we should show
the "you must use application/json" error message instead of
crashing.