New posts in Strict Transport Security

For which Content-Types should I set security related HTTP response headers?

Cookies are not accessible within JavaScript (and the dev tools) but sent along with XHR request (no httponly used)