Why Content-Type matters
Browsers decide how to handle a response largely from its Content-Type, not its file extension. Serve JavaScript as text/plain and the browser refuses to execute it; serve a PDF as application/octet-stream and it downloads instead of previewing. Modern browsers also enforce X-Content-Type-Options: nosniff, so a wrong type is fatal, not forgiven.