fixup! NXD xblob: don't let net/http sniff content type

support rendering svg as images, while still applying a CSP and forcing download to prevent executing javascript they may contain