Disable MIME sniffing by default

The lack of `X-Content-Type-Options "nosniff"` header can lead to
cross-origin data leaks.

For more in-depth information on how this can be done, please see
@hasegawayosuke's slides from OWSP AppSec APAC 2014:
http://www.slideshare.net/hasegawayosuke/owasp-hasegawa.