Quote Content-disposition header

Without quoting (technically mandatory anyhow) a comma in the filename is interpreted in strange and exciting ways by Chrome.