Revert "add X-Content-Type-Options: nosniff"

This reverts commit 71d5f51ae6.

csp.go

@@ -5,9 +5,8 @@ import (
 )
 
 const (
-	cspHeader                = "Content-Security-Policy"
-	frameOptionsHeader       = "X-Frame-Options"
-	contentTypeOptionsHeader = "X-Content-Type-Options"
+	cspHeader          = "Content-Security-Policy"
+	frameOptionsHeader = "X-Frame-Options"
 )
 
 type csp struct {
@@ -27,7 +26,6 @@ func (c csp) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	}
 
 	w.Header().Set(frameOptionsHeader, c.opts.frame)
-	w.Header().Set(contentTypeOptionsHeader, "nosniff")
 
 	c.h.ServeHTTP(w, r)
 }

csp_test.go

@@ -11,7 +11,6 @@ import (
 var testCSPHeaders = map[string]string{
 	"Content-Security-Policy": "default-src 'none'; style-src 'self';",
 	"X-Frame-Options":         "SAMEORIGIN",
-	"X-Content-Type-Options":  "nosniff",
 }
 
 func TestContentSecurityPolicy(t *testing.T) {