Fix cross-site scripting in status_json by specifying nosniff and app/json content