Would this be blocked by the X-CONTENT-TYPE-OPTIONS header? (source: http://ibuildings.nl/blog/2013/03/4-http-security-headers-yo... )