Set the Content-Disposition to tell the browser to download the file instead of showing its content on the page.
resp = make_response(df.to_csv())
resp.headers["Content-Disposition"] = "attachment; filename=export.csv"
resp.headers["Content-Type"] = "text/csv"
return resp