Add a Content-Type header when serving secure media (fixes #37)