feat(server): Add `x-content-type-options: nosniff` headers to prevent browser content type sniffing.



fixes #1165