The crucial part is the "Content-disposition" parameter.
Incidentally, you should use
Content-disposition: attachment; filename=file
Instead of "inline" if you really want the save-as box to pop up.
It probably won't make any difference, but it could if the user
has a program set up to handle the content-type you're returning (for example, if you're returning a pdf file).
Incidentally, the RFC on HTTP/1.1 only defines behavior with "attachment".
(And that only in an appendix under "Additional Features")
