server: Add Content-Disposition header to trigger file download