By far the easiest way to grok this sort of magic is simply to go to a site that is now doing what you want, and then to examine the HTML response-packet that was returned using the browser’s own built-in (or add-on...) debugging facilities.   The secret sauce to this particular problem is, indeed, the specifying of content-type and/or disposition in the HTML header.   But a concrete example is worth a thousand guesses, and in this case it is very easily obtained.