escape content-disposition filename

should fix: http://manage.dimagi.com/default.asp?97979