http://drupal.org/node/61528 Ever since it was released, the upload module has added a Content- Disposition header when the files are set to private. Browsers that understand this header use it to determine whether to download the file or display it in a browser window. Users find it confusing when their browsers don't behave consistently. For example, PDF files display in a browser window when files are set to public (no Content-Disposition header), but they have to be saved if files are set to private (Drupal adds a "Content- Disposition: attachment" header). Why don't we leave off this header so files can be handled consistently according to the settings users have made in their browsers?