Your content-disposition header is causing the browser to save the file instead of displaying it inline. You still need the content-type header, but try it after removing content-disposition.
http://www.w3.org/Protocols/rfc2616/rfc2616-sec19.html#sec19.5.1
If this header is used in a response with the application/octet- stream content-type, the implied suggestion is that the user agent should not display the response, but directly enter a `save response as...' dialog.
This has over time morphed into "the content should be saved directly if content-disposition is sent". Most browsers seem to behave this way, in my experience.