fix #616: Json content-type not restrictive enough

Possible security issue. See https://github.com/defnull/bottle/issues/616 for details.