The HTTP standard says:
If this header [Content-Disposition: attachment] is used in a response
with the application/octet-stream content-type, the implied
suggestion is that the user agent should not display the response, but
directly enter a `save response as…’ dialog.
I read that as
Content-Type: application/octet-stream
Content-Disposition: attachment
But I would have thought that Content-Type would be application/pdf, image/png, etc.
Should I have Content-Type: application/octet-stream if I want browsers to download the file?
