well, pinpointed in the right direction, but sadly it doesn't work.....after creating a dummy controller just to let the request be accepted, I think I found the culprit:
raise HTTP(200, response.stream(file), headers) will stop execution, but raising actually from response.stream, that calls stream_file_or_304_or_206, so headers are set in that call, and not the one raised from the model itself. next step, check stream_file_or_304_or_206, *Cache-Control : private* is set as fixed, so overriding it in response.stream call or even calling directly stream_file_or_304_or_206 won't work. Adding an Expires header won't work nonetheless, because for HTTP specs Cache-Control "wins" over Expires header ...... The only way is to use streamer directly, but all other headers, content-type detection, etc would need to be rewritten
