That looks about right to me. It a good idea to set the content length of the response as well. I've run into trouble with that before, but it was only when sending the response to a non-standard browser. The normal browsers seemed happy enough with the 0 content length.
If you expect the file to be large, you could read it a chunk at a time and write each chunk immediately to the output stream. That avoids having the whole file resident in a byte array. Actually, unless you need the file for other reasons, you could just let the CSVWriter() write it directly to the
servlet output stream (well, through a OutputStreamWriter anyway). In that case, you probably won't know the size though, so you have to hope a 0 content length won't freak out your client.