fix content-disposition header and generate valid filenames

1. HTTP 1.1 section [19.5.1](http://www.w3.org/Protocols/rfc2616/rfc2616-sec19.html) defines that the filename must be quoted: 
```filename-parm = "filename" "=" quoted-string```
Some user agents misbehave if the quotes are missing.

2. Strip characters not meant for filenames on some operating systems.