change how content-type enforcement is handled

If no content types are specified, then accept all responses, regardless
of content type (this is the behavior imageproxy has historically had).
Change default value for the contentTypes flag to be "image/*", so that
the new default when running cmd/imageproxy is that only images will be
proxied.  The old default behavior can be achieved by passing an empty
string for the contentTypes flag:

    imageproxy -contentTypes ""

Do not send the "XCTO: nosniff" header, since all documentation that I
can find still says that it can cause problems when served with images.
If it's effectively a noop when an explicit content-type is specified in
the response, then this shouldn't actually matter for us either way.
But in the absence of certainty, I'd rather err on the side of following
the spec.

Also add documentation for the new functionality.

Fixes #141

README.md

@@ -175,6 +175,14 @@ Reload the [codercat URL][], and you should now get an error message.  You can
 specify multiple hosts as a comma separated list, or prefix a host value with
 `*.` to allow all sub-domains as well.
 
+### Content-Type whitelist ###
+
+You can limit what content types can be proxied by using the `contentTypes`
+flag. By default, this is set to `image/*`, meaning that imageproxy will
+process any image types. You can specify multiple content types as a comma
+separated list, and suffix values with `*` to perform a wildcard match. Set the
+flag to an empty string to proxy all requests, regardless of content type.
+
 ### Signed Requests ###
 
 Instead of a host whitelist, you can require that requests be signed.  This is