Display PDFs and media inline

This change causes user uploads of PDFs, images, video and audio to be served with `Content-Disposition: inline` rather than `Content-Disposition: attachment`, making browsers display them inline rather than trigger a download. An `X-Content-Type-Options: nosniff` header is included to reduce the risk of MIME type hacking.

Bundled in to this pull request is a typo fix related to filename collision handling. I've tested that both this and the above work as advertised.