[286c8cb04bda]

It's sending the "wrong" one --

    $ curl -I http://lcamtuf.coredump.cx/squirrel/
    HTTP/1.1 200 OK
    Date: Thu, 11 Aug 2016 05:18:00 GMT
    Server: Apache
    Last-Modified: Mon, 19 Sep 2011 23:31:49 GMT
    Accept-Ranges: bytes
    Content-Length: 135938
    Content-Type: text/html

[TazeTSchnitzel]

Oh. Huh. My bad.

I guess browsers only forbid ignoring Content-Type for stuff like JS, then. For JPEG it's probably not a security concern.