It pains me to think about the important ones like varying on session cookie and authorization headers, and how badly some middleware can confuse things.

We generate custom content for a given authentication context. We definitely want caching at the user agent, but we want the cache keyed by the authenticated identity. Otherwise something like logging out and logging in as a different identity can produce monstrously confused results when an SPA or similar mixes some cached and some fresh responses into one page.

Imagine if we actually built a remote application delivery platform instead of cobbling one onto a glorified document reader