To the hell with "Error: Access is Denied"
Didn't bother to solve the "X-File". Several colleagues proposed a workaround. Load the file download code via a pop-up (ala GMail) or do it through a hidden iFrame. The first "solution", was dropped after I found that it doesn't work on HTTPS. So had use the second way. However, I struggled all afternoon to reference the stupid iFrame via JS to set its src property. Then it hit me, just write the bloody HTML into the page straight via a Literal object. Argggh! At least the job is done.