Browsers really like to make a "best effort" at guessing the content, even if they have to deviate from the Content-Type: text/html; charset=utf-8 header. Which is why eliminating all intermediaries and cross-checking all steps is the only approach I know that works.