An interesting gotcha that I stumbled across recently, sending a 404 response code with a download forced by Content-Disposition: attachment will fail but inline content will still be displayed. This behaviour was tested in both Chrome and FireFox. Of course the appropriate response code should always be sent; this 404 response code was being sneaked in by WordPress and led to hours of frustration.