in src/main/java/org/apache/sling/commons/log/webconsole/internal/LogWebConsolePlugin.java [124:126]
private static void addNoSniffHeader(HttpServletResponse resp) { resp.setHeader("X-Content-Type-Options", "nosniff"); }