ob_end_clean should be called BEFORE headers are sent

Follow-up to commit b341ca89c83b9d906b229d289c35dfcc1185b034

ob_end_clean throws away the output buffer instead of flushing it to the
client. Therefore we should call this BEFORE the file download headers
are sent to the client or else these headers could potentially be thrown
away/lost.

Note to self: don't rely upon incorrect comments in the code that tell
you ob_end_clean flushes the buffer... look it up in the PHP manual!