One thing I've noticed with Content-type: application/octet-stream is that certain browsers will still try and load the file in the browser instead of thowing up a save as dialog. (Certain versions of IE will do this.) I usually use application/unknown, although I'm not sure that it's 100% successful.