I had a different set of criticisms, such as: mandatory TLS, no file size in the response, no range requests, etc. (I made up my own in order to address these and some others.)