This file is being sent with the type "application/octet-stream". That basically tells the browser "here are some bytes, don't try to interpret them as anything".
Your browser should NOT be displaying this file.
Your browser should ask you to save this file to disk, or possibly allow you to select a helper application to use to view it.
Although this file may look like HTML, it isn't. It's binary data, in which anything is allowed, including things that look like HTML.