> In HTTP, the "cache-control: private" directive is defined > with normative language for HTTP implementations about which > bits they may or may not "share" with other users. clever, but it's not quite the same thing. cache-control limits what an HTTP intermediary can do with the file, but doesn't place any restrictions on the user.