You're definitely on the right track with that content-type header. The RFC (I forget which one) says that the client must use the encoding specified in the Content-type header in preference to any encoding declaration in the document itself. I think in the absence of a charset=... on the Content-type header, the client is meant to assume latin-1. So you should declare your UTF-8 encoding both in your header and in your XML declaration.

The next question is: are you actually generating UTF-8 data? In our Mason app, we found we needed to add this line to our Apache config:

  PerlSetVar  MasonPreamble           "use utf8;"
[download]

Without this line, literal Unicode characters in our Mason templates were having extra bytes inserted when the template was compiled.

To check if the output really is UTF-8, I'd use wget to request a URL and save it to a file then use a hex-dumper like xxd (comes with Vim) to view the file as bytes.