Use "octet-stream" as content-type + force download

From a security PoV this is much better.

@DeepDiver1975