Should we add a note that resource is "public by default"? I guess that's implicit in the statement about intermediary caches, but I think it's worth calling out.