The biggest mental rewiring required when adopting SXG: stop treating HTTP responses as personalized, request-scoped artifacts. A single signed response is reused for many requests across users, so it must be cache-friendly (public Cache-Control, max-age 120 s – 7 days), contain no server-side personalization, no server-side cookies, and no HSTS. On Rails in particular, this means moving session cookies, avatar/username rendering, CSRF and similar concerns to client-side endpoints.