enforce X-Content-Type-Options nosniff on json responses