1) the code to download the file was before the Post recordset, i moved the download code block to be after the post recordsdet.
2) The encoding for the page had the BOM SIgnature enabled, the BOM Signature must be disabled.
the BOM settings can be found by going to Manage -> Page Properties.
in the page properties go to the title / encoding section. make sure the checkbox to enable the BOM signature is not checked.