This is a good option, if you clearly know its limits:

• dixit RFC 2616 (HTTP/1.1):

  Content-Disposition is not part of the HTTP standard, but since it is widely implemented, we are documenting its use and risks for implementors.

• dixit Java Enterprise Best Practices:

  The bad news is that [...] many browsers second-guess the server's directives and do what they think is best rather than what they're told. These browsers--including Microsoft Internet Explorer and Opera--look at the file extension and "sniff" the incoming content. If they see HTML or image content, they inline-display the file contents instead of offering a Save As dialog.

I just wanted to be rigorous. BTW last reference explains how to circumvent browser oddities with Content-disposition.