fix #616: Json content-type not restrictive enough

Possible security issue. See https://github.com/defnull/bottle/issues/616 for details.
Release of 0.10.12 (Security fix)