Set Content-Type header on js and css resources.
Set X-Content-Type-Options in browser-policy-content
nim, glasser comments
Add Content-Type to history
Merge branch 'content-type-headers' into devel
selftest: return null when reading a file that doesn't exist
Stricter validation of connect messages

Previously, you could leave out the "support" field (or claim to not
support the version you were proposing) which would mean your connection
would succeed iff the proposed version is the server's favorite
version. This led to (eg) ObjectiveDDP accidentally writing a client
that stopped working when servers started preferring pre2 over pre1. By
making this a blatant error, DDP client libraries are more likely to
be written in a way that works with version negotiation.

Also, remove the delay in sending connect failure messages, which was
intended to avoid connect storms from clients that are by now 1.5 years
old.

Fixes #2125.
Update commandline.html

Removed deprecated --password command from docs. Added info on new practices.
cleanup HTML
Merge branch 'pr/2117' into devel

Fixes #2117.
Unregister sessions from server when their heartbeats time out.