Set x-content-type-options when returning data with well-known content-type
See: https://webhint.io/docs/user-guide/hints/hint-x-content-type-options/?source=devtools