Do not serve non-HTML content that may contain JavaScript in such a way that web browsers execute it.
This option will prevent Galaxy from correctly rendering SVG files generated from tools or uploaded by users and so can be disabled with by setting the new option serve_xss_vulnerable_mimetypes in universe_wsgi.ini to True.

Thanks to Tobias Sargeant for pointing out this problem.
Merged in jmchilton/galaxy-central-fork-1/stable (pull request #333)

Disable rendering of user uploaded/tool generated SVG files.
Merge latest stable.