Handle application/octet-stream as a universal download mime type.

However without the 'X-Content-Type-Options: nosniff' security header, an html
file with application/octet-stream could be parsed by the browser and
displayed/executed as html.

So set the X-Content-Type-Options header when using this codepath.
client.py sets this header when the SendFile exception is raised for the same reason.