Enforce downloads with a Content-Disposition header