Rather than sending the correct content type (which would then be interpreted by the browser, and possibly displayed), send 'application/octet-stream', which is basically used as a catch-all for streamed data.
With that change, it should work fine in all browsers.