I'd also like to learn more about the xpsId header - x-playback-session-id - and whether it's relevant here. It seems to be a token for an individual, a bit like the ULID that nostr:npub1ln5q8np5aezhtt7ztv6tah86xk4t3smjuchdvxp0u6uta056204q45xyw6 and others were proposing. But, at least with these two requests for the same audio from the same person one millisecond apart, it doesn't seem to actually be a session ID.

https://assets.bne.social/media_attachments/files/111/069/073/017/420/252/original/0485f80092bf667c.png