Disable MIME sniffing by default

http://www.slideshare.net/hasegawayosuke/owasp-hasegawa demonstrates how the lack of `X-Content-Type-Options "nosniff"` headers can lead to cross-origin data leaks.