... and the missing newline explains exactly what happened:
The browser treated everything up to the first newline as a content-type, didn't recognize it, and therefore opened as "save as" dialog instead of displaying it.

And it had no filename specification, so it used the script name from the URL.