Set to nosniff to stop the browser guessing a response's content type instead of trusting Content-Type.