Merge headers

Otherwise the headers from `JSONResponse` are gone and the Content-Type of the response would be `text/html` instead of `application/json; charset=utf-8`. This leads to broken scripts since we set the `nosniff` header, furthermore this is very bad from a security PoV.

Fixes itself.

@Raydiation @MorrisJobke