Use secure mimetype for content delivery

Adds some hardening against potential CSP bypassed.