infer content type from contents of file instead of its file extension
* defaults to application/binary as its more secure than octet-stream
* set nosniff header to instruct browsers not to guess content type