are you sure that you are not seeing a cached response from dispatcher?
if it is being cached then unless you configure dispatcher to cache
headers also see Configuring Dispatcher "Caching HTTP Response
Headers"Also, just "Content-Disposition" : "attachment, does not set the
filename. In the absence of filename in header, it will probably guess
it from the url.