Update CREDITS
Fix invalid link in 'nosniff' header comment

Missed that occurence in html_api.php when I updated it in
file_download.php (e66ecc9f886a97a3b54a8bdaa9afbfa6902f1d9a).
Bump version and update release notes for 1.2.18