Improved download: atomic write and content-type validation