set the content type like this and try..
response.setContentType("application/vnd.ms-excel")
and uncomment this line
out.flush();