Shared cache model. No cache was contacted.

The account response is private to the caller.
Mark it private so a shared cache does not store it.
Also align routes: a path the cache treats as a public file must not be answered with the account page.

Deception on this card: the stored response belongs to one person and is later handed to another.
Poisoning on the optional card: the stored response is replaced, and later callers receive the replacement.