send as content-type application/javascript to work with IE nosniff
add cache-control, access-control-allow-origin, and vary headers to match all other js file headers
Merge pull request #4113 from jrgm/fix-no-sniff-content-type

fix a couple of js urls to send as content-type application/javascript to work with IE nosniff