Use BlobHelper#content_type instead of #mime_type.

This provides Content-Type with a proper charset, and plugs a security
hole that a raw HTML file is served with a browser executable MIME
type (text/html) from the same domain where users are authenticated.