nevermind, content-type of `text` will be sent with content-disposition `attachment` and `nosniff` should prevent browsers to do anything else.. i mean.. `Browsers`...

(if that discussion weren't public I would :boom:)