Add separate prefixes for clients and servers so separated auth is easier
ETag cache
Server-side hash?
Log / audit log?
Prevent directory traversal attacks
Error handling
Reverse proxy to other local servers