Tom,

thanks for your remark!

We have exchanged a couple of letters with Jan off the list,
and I hope your point of view helps to motivate a change in the current
approach.

Here is my impression (has nothing to do with Jan's or somebody else's
standpoint) :

As it looks, it is not possible to arrange a consistent behaviour
by a simple fix (given my very high expectations of consistency).

It looks like each user's cache should (logically) be isolated from the
others' ones, which means the current approach - a common cache
with little per-user information at each object - is not sufficient
to ensure both correct semantics and higher security.

Fortunately, I believe, it is possible to do it right,
without running one-client-per-user and without too much hassle,
though it is not at all trivial. Let's see what happens.

Yours,
--
Ivan