Could this have been harder to do if the insecure server inspected the HTTP content-type and response body in the response? Something like this (psuedo-code):

Could this have been harder to do if the insecure server inspected the HTTP content-type and response body in the response? Something like this (psuedo-code): if response.content_type =~ /image-/i && !plain_text?(response.body) pass else fail!() end