When serving a file, serve it with a content length.
Quote the filename in the content-disposition header.

Kinda grubby, we should escape the filename...