Fix XSS vulnerability for html files served up with "Content-Disposition attachment" headers

This is a slightly more complete fix for the XSS issues identified in #195 that covers the case where untrusted user-uploaded html files are served up with one of the correct html Content-types and "Content-Disposition: attachment" headers (https://github.com/rails/turbolinks/issues/195#issuecomment-52037314). Test case included.
What do you think about naming this `downloadingFile` instead?  Then the conditions could be rewritten to `if not clientOrServerError() and not downloadingFile() and validContent()`