Bugfix 2943: Fix cross-site scripting in status_json by specifying nosniff and app/js...

Guard against CSS in IE6 and IE8 by specifying X-Content-Type-Options: nosniff and not using plain text content type.