all: Change Content-Disposition header to RFC5987

* The client should now send the filename percent-encoded
* Filenames with spaces or Unicode should now be presented correctly to
  (modern) browsers