security fix: when showing potentially dangerous text/* types, emit them as text/plain (and turn the stupid browser sniffer off)