argh, SO user just informed us that IE6/7 will do content sniffing and render text/plain as HTML, even if it would be an exploit to do so(!)