Hacker News Reader

If it doesn't leave the browser, how would the server know to serve the private content?

Client web app makes POST request. It leaves browser, but not in URL

That only works if you can run JavaScript. If you want to download a file with curl for example it fails.