This follows draft-ietf-websec-mime-sniff-03 in its intent,
though not its algorithmic specification.

R=rsc
CC=golang-dev
https://golang.org/cl/4746042