deps: debug@~2.0.0
tests: check global leaks
Set X-Content-Type-Options: nosniff header