Essentially you set the content type and 'filename' on the response. The lines for these should be obvious. You use a FileInputStream of some other type of stream to suck in a file, then pump it down the OutputStream. When you run out of data, stop.
Actually there is a bug in the bos.write(bytesRead) line, that's not right at all. Icky code.