Per the document Kristo and I worked on about server-side caching rules for OPDS feeds, the only item that needs immediate attention is this one:

• An authenticated request to an individual OPDS entry sets Cache-Control: private, no-transform, max-age=1800

This violates the first rule that max-age should not be used at all for customized documents, since the cache might be invalidated at any moment.