Thomas Broyer wrote:
...
You can already handle the case of content that's available unauthenticated,
but would potentially differ in case of being authenticated by adding
Vary: Authorization
to a response.
I seem to recall Roy T. Fielding arguing *against* that when we were
discussing user-specific service documents in the Atom Protocol group.
...
It's not needed when the resource only allows authenticated access.
It *will* be necessary (or some other response header dealing with
caching) if you mix both authenticated and anonymous access to the same
resource.
BR, Julian
