I guess browsers only forbid ignoring Content-Type for stuff like JS, then. For JPEG it's probably not a security concern.