visiting /json?download sets content-disposition header.