According to http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9.1, I would use "private" here, as the response is intended for the particular user who has requested it. "Private" implies the response might be cached by the client only. It won't be cached on Varnishes.