disallow HTML or text or blank content type on DELETE or PUT or POST

[StephanWald]

This is part of the OWASP guidelines, we should probably double check also for their other recommendations

See https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html