[WIP] infer content type from contents of file instead of its file extension

* always set content-type on file uploads, default to a sensible default if no type can be retrieved
* sensible defaults to application/binary as its more secure than octet-stream (see: http://security.stackexchange.com/q/12896)
* set nosniff header when displaying attachments to instruct browsers not to guess content type
* Mime::Types gets content types by file extensions, that's not enough 
* uses file binary to cross-check proposed content types by Mime::Types
* some controller cleanup as we can assume that content_type is set
** after_initialize defaults to sensible default for attachments already in the database