- name: private-ssr-cache-header
  where: "src/routes/orders/+page.server.ts"
  ensure: >-
    The authenticated orders load must set cache-control to private, no-store and must not advertise public caching.