The order used may differ from browser to browser, but a readable meta tag usually wins over HTTP headers.

I thought that's what I said. :P Also of note if we're kitchen sinking it is that there have been serious security implications of not having the charset right; utf-7-xss-attacks-in-modern-browsers.