fix missing & broken X-Content-Type-Options

Missed default recommended settings. Also adds missing quote in backwards compatible `X-Content-Type-Options` settings.