diff --git a/core/src/main/java/hudson/security/HudsonFilter.java b/core/src/main/java/hudson/security/HudsonFilter.java
index 40c7e7c69d..e59e9d4e7e 100644
--- a/core/src/main/java/hudson/security/HudsonFilter.java
+++ b/core/src/main/java/hudson/security/HudsonFilter.java
@@ -36,6 +36,7 @@ import javax.servlet.ServletContext;
 import javax.servlet.ServletException;
 import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletResponse;
 
 import org.acegisecurity.AuthenticationManager;
 import org.acegisecurity.ui.rememberme.RememberMeServices;
@@ -153,7 +154,10 @@ public class HudsonFilter implements Filter {
 
     public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
         LOGGER.entering(HudsonFilter.class.getName(), "doFilter");
-        
+
+        // this is not the best place to do it, but doing it here makes the patch smaller.
+        ((HttpServletResponse)response).setHeader("X-Content-Type-Options", "nosniff");
+
         // to deal with concurrency, we need to capture the object.
         Filter f = filter;
 
diff --git a/core/src/main/java/hudson/util/FormValidation.java b/core/src/main/java/hudson/util/FormValidation.java
index 12b6c069d2..ac471cb958 100644
--- a/core/src/main/java/hudson/util/FormValidation.java
+++ b/core/src/main/java/hudson/util/FormValidation.java
@@ -199,7 +199,7 @@ public abstract class FormValidation extends IOException implements HttpResponse
             " <a href='#' class='showDetails'>"
             + Messages.FormValidation_Error_Details()
             + "</a><pre style='display:none'>"
-            + Functions.printThrowable(e) +
+            + Util.escape(Functions.printThrowable(e)) +
             "</pre>",kind
         );
     }
diff --git a/core/src/main/java/jenkins/security/ApiTokenProperty.java b/core/src/main/java/jenkins/security/ApiTokenProperty.java
index caa9ed8853..124d8bd78f 100644
--- a/core/src/main/java/jenkins/security/ApiTokenProperty.java
+++ b/core/src/main/java/jenkins/security/ApiTokenProperty.java
@@ -81,6 +81,7 @@ public class ApiTokenProperty extends UserProperty {
     }
 
     public void changeApiToken() throws IOException {
+        user.checkPermission(Jenkins.ADMINISTER);
         _changeApiToken();
         if (user!=null)
             user.save();
diff --git a/core/src/test/java/hudson/util/FormValidationTest.java b/core/src/test/java/hudson/util/FormValidationTest.java
index 7f22a1371e..717d1768f4 100644
--- a/core/src/test/java/hudson/util/FormValidationTest.java
+++ b/core/src/test/java/hudson/util/FormValidationTest.java
@@ -28,6 +28,9 @@ import static org.junit.Assert.*;
 import java.util.Arrays;
 
 import org.junit.Test;
+import static org.hamcrest.CoreMatchers.containsString;
+import static org.hamcrest.CoreMatchers.not;
+import static org.hamcrest.MatcherAssert.assertThat;
 
 /**
  * @author sogabe
@@ -105,4 +108,10 @@ public class FormValidationTest {
     private FormValidation aggregate(FormValidation... fvs) {
         return FormValidation.aggregate(Arrays.asList(fvs));
     }
+
+    @Test
+    public void formValidationException() {
+        FormValidation fv = FormValidation.error(new Exception("<html"), "Message<html");
+        assertThat(fv.renderHtml(), not(containsString("<html")));
+    }
 }
diff --git a/test/src/test/java/hudson/model/UserTest.java b/test/src/test/java/hudson/model/UserTest.java
index 588726f251..800d1862a9 100644
--- a/test/src/test/java/hudson/model/UserTest.java
+++ b/test/src/test/java/hudson/model/UserTest.java
@@ -28,6 +28,7 @@ import com.gargoylesoftware.htmlunit.FailingHttpStatusCodeException;
 import com.gargoylesoftware.htmlunit.WebAssert;
 import com.gargoylesoftware.htmlunit.html.HtmlForm;
 import com.gargoylesoftware.htmlunit.html.HtmlPage;
+
 import hudson.security.AccessDeniedException2;
 import hudson.security.GlobalMatrixAuthorizationStrategy;
 import hudson.security.HudsonPrivateSecurityRealm;
@@ -41,9 +42,13 @@ import java.util.Collections;
 
 import jenkins.model.IdStrategy;
 import jenkins.model.Jenkins;
+import jenkins.security.ApiTokenProperty;
+
+import org.acegisecurity.AccessDeniedException;
 import org.acegisecurity.Authentication;
 import org.acegisecurity.context.SecurityContext;
 import org.acegisecurity.context.SecurityContextHolder;
+
 import static org.junit.Assert.*;
 import static org.junit.Assume.*;
 import org.junit.Rule;
@@ -498,6 +503,42 @@ public class UserTest {
         assertTrue("But once storage is allocated, he can be deleted", user3.canDelete());
     }
 
+    @Test
+    // @Issue("SECURITY-180")
+    public void security180() throws Exception {
+        final GlobalMatrixAuthorizationStrategy auth = new GlobalMatrixAuthorizationStrategy();
+        j.jenkins.setAuthorizationStrategy(auth);
+        j.jenkins.setSecurityRealm(j.createDummySecurityRealm());
+
+        User alice = User.get("alice");
+        User bob = User.get("bob");
+        User admin = User.get("admin");
+
+        auth.add(Jenkins.READ, alice.getId());
+        auth.add(Jenkins.READ, bob.getId());
+        auth.add(Jenkins.ADMINISTER, admin.getId());
+
+        // Admin can change everyone's token
+        SecurityContextHolder.getContext().setAuthentication(admin.impersonate());
+        admin.getProperty(ApiTokenProperty.class).changeApiToken();
+        alice.getProperty(ApiTokenProperty.class).changeApiToken();
+
+        // User can change only own token
+        SecurityContextHolder.getContext().setAuthentication(bob.impersonate());
+        bob.getProperty(ApiTokenProperty.class).changeApiToken();
+        try {
+            alice.getProperty(ApiTokenProperty.class).changeApiToken();
+            fail("Bob should not be authorized to change alice's token");
+        } catch (AccessDeniedException expected) { }
+
+        // ANONYMOUS can not change any token
+        SecurityContextHolder.getContext().setAuthentication(Jenkins.ANONYMOUS);
+        try {
+            alice.getProperty(ApiTokenProperty.class).changeApiToken();
+            fail("Anonymous should not be authorized to change alice's token");
+        } catch (AccessDeniedException expected) { }
+    }
+
      public static class SomeUserProperty extends UserProperty {
          
         @TestExtension
diff --git a/test/src/test/java/jenkins/security/Security177Test.java b/test/src/test/java/jenkins/security/Security177Test.java
new file mode 100644
index 0000000000..c212cba2d2
--- /dev/null
+++ b/test/src/test/java/jenkins/security/Security177Test.java
@@ -0,0 +1,36 @@
+package jenkins.security;
+
+import com.gargoylesoftware.htmlunit.Page;
+import java.net.URL;
+import static org.junit.Assert.assertEquals;
+import org.junit.Rule;
+import org.junit.Test;
+import org.jvnet.hudson.test.Issue;
+import org.jvnet.hudson.test.JenkinsRule;
+import org.jvnet.hudson.test.JenkinsRule.WebClient;
+
+/**
+ * @author Kohsuke Kawaguchi
+ */
+@Issue("SECURITY-177")
+public class Security177Test {
+    @Rule
+    public JenkinsRule jenkins = new JenkinsRule();
+    
+    @Test
+    public void nosniff() throws Exception {
+        WebClient wc = jenkins.createWebClient();
+        wc.setThrowExceptionOnFailingStatusCode(false);
+
+        URL u = jenkins.getURL();
+        verifyNoSniff(wc.getPage(new URL(u, "adjuncts/507db12b/nosuch/adjunct.js")));
+        verifyNoSniff(wc.getPage(new URL(u, "no-such-page")));
+        verifyNoSniff(wc.getPage(new URL(u, "images/title.svg")));
+        verifyNoSniff(wc.getPage(u));
+    }
+
+    private void verifyNoSniff(Page p) {
+        String v = p.getWebResponse().getResponseHeaderValue("X-Content-Type-Options");
+        assertEquals(v,"nosniff");
+    }
+}