You'd think this would be enough protection, but it turns out that some browsers (looking at you, IE) actually try to infer the content type from the page conte

You'd think this would be enough protection, but it turns out that some browsers (looking at you, IE) actually try to infer the content type from the page content. See http://msdn.microsoft.com/en-us/library/ms775147(v=vs.85).aspx http://msdn.microsoft.com/en-us/library/ms775147(v=vs.85).as... for more info.