# print a simple content-type which will ensure we're not at
# risk of XSS attacks, etc.
print "Content-type: text/plain\n\n";
[download]

Just throwing this out there. IE does not respect content type headers over some of its other content heuristics and some servers write their own headers no matter what the CGI sends. So that might not be safe in edge cases. :(