Merge headers

Otherwise the headers from `JSONResponse` are gone and the Content-Type of the response would be `text/html` instead of `application/json; charset=utf-8`. This leads to broken scripts since we set the `nosniff` header, furthermore this is very bad from a security PoV.

Fixes itself.

@Raydiation @MorrisJobke 
I love that we even had simply wrong unit tests. They just test exactly what is done and not what is wanted -> therefore write the test in a way you want to have a feature and not how the feature is.