test cases, fix
Merge pull request #441 from frohoff/fix-disposition-xss

Fix XSS vulnerability for html files served up with "Content-Disposition attachment" headers