diff -r 89002d07a114 -r 98baf8dea553 mercurial/hgweb/hgwebdir_mod.py
--- a/mercurial/hgweb/hgwebdir_mod.py	Sat Mar 10 15:37:29 2018 -0800
+++ b/mercurial/hgweb/hgwebdir_mod.py	Sat Mar 10 15:46:29 2018 -0800
@@ -230,12 +230,14 @@
 
     def _runwsgi(self, wsgireq):
         req = wsgireq.req
+        res = wsgireq.res
 
         try:
             self.refresh()
 
             csp, nonce = cspvalues(self.ui)
             if csp:
+                res.headers['Content-Security-Policy'] = csp
                 wsgireq.headers.append(('Content-Security-Policy', csp))
 
             virtual = wsgireq.env.get("PATH_INFO", "").strip('/')
@@ -243,6 +245,10 @@
             ctype = tmpl('mimetype', encoding=encoding.encoding)
             ctype = templater.stringify(ctype)
 
+            # Global defaults. These can be overridden by any handler.
+            res.status = '200 Script output follows'
+            res.headers['Content-Type'] = ctype
+
             # a static file
             if virtual.startswith('static/') or 'static' in req.qsparams:
                 if virtual.startswith('static/'):
@@ -256,8 +262,9 @@
                     if isinstance(tp, str):
                         tp = [tp]
                     static = [os.path.join(p, 'static') for p in tp]
-                staticfile(static, fname, wsgireq)
-                return []
+
+                staticfile(static, fname, res)
+                return res.sendresponse()
 
             # top-level index