So, shortly after posting this question, I ran across this issue on Github. It apparently has to do with using CORS.
The suggested work around was adding Access-Control-Expose-Headers:Content-Disposition to the response header on the server.
This worked!