Notes: set response type to text/plain to prevent XSS attacks