Fail gracefully if not content-type header is given.

Clients may not send any content-type header in the verification request.  We should fail, but not like this:

```
{
  "status": "failure",
  "reason": "TypeError: Cannot call method 'indexOf' of undefined"
}
```

This PR does the minimal work necessary to give a descriptive error; it may be more developer-friendly to return an explicit "Missing Content-Type header" message.