diff --git a/README.md b/README.md
index 8ad3fd0..6e56a1b 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@ hosting its own server or even having a public IP.
 
 The primary use case is to share diagnostic and contextual information
 produced by Fediverse bots (think an interactive game where the game board 
-is rendered to an image or text file on demand). There are sure to be many 
+is rendered to an image or a text file on demand). There are sure to be many 
 other uses I didn't think of.
 
 The uploaded files have a lifetime of 10 minutes, which can be shortened or 
@@ -31,7 +31,6 @@ $ curl -X POST --data-binary @RICKROLL.txt 0.0.0.0:7745 -i
 HTTP/1.1 200 OK
 X-Secret: 5273d775746e393b
 X-Expire: 599
-Content-Length: 16
 
 421d082ef85827ea
 ```
@@ -45,6 +44,7 @@ and share it. The URL is `/<FILE_ID>`, e.g.
 $ curl -X GET 0.0.0.0:7745/421d082ef85827ea -i
 HTTP/1.1 200 OK
 Content-Type: text/plain; charset=utf8
+Cache-Control: public, max-age=459
 X-Expire: 459
 Content-Length: 688
 
@@ -58,6 +58,11 @@ If you wish to set a custom type, use the `Content-Type` header when uploading t
 
 ```
 $ curl -X POST --data-binary @RICKROLL.txt 0.0.0.0:7745 -i -H 'Content-Type: application/json'
+HTTP/1.1 200 OK
+X-Secret: 5273d775746e393b
+X-Expire: 599
+
+421d082ef85827ea
 ```
 
 ### Expiration time
@@ -66,6 +71,11 @@ To customize the expiration time, use the header `X-Expire: <secs>`, or a URL pa
 
 ```
 $ curl -X POST --data-binary @RICKROLL.txt 0.0.0.0:7745 -i -H 'X-Expire: 60'
+HTTP/1.1 200 OK
+X-Secret: 5273d775746e393b
+X-Expire: 59
+
+421d082ef85827ea
 ```
 
 ## Updating a file
@@ -82,8 +92,34 @@ Note that sending `PUT` with empty body will *not* clear the file, in that case
 not changed at all. This can be used to extend a file's expiration without changing it in any other way
 (by sending the `X-Expire` header).
 
+Example, changing `Content-Type`:
+
+```none
+$ curl -X PUT 0.0.0.0:7745/08b515d619419115 -i -H'Content-Type:image/ascii' -H'X-Secret:32064a5fdb0ca799'
+HTTP/1.1 200 OK
+
+Updated OK.
+```
+
+Example, changing the expiration time:
+
+```none
+$ curl -X PUT 0.0.0.0:7745/08b515d619419115 -i -H'X-Expire:600' -H'X-Secret:32064a5fdb0ca799'
+HTTP/1.1 200 OK
+X-Expire: 599
+
+Updated OK.
+```
+
 ## Deleting a file
 
 The `DELETE` verb, unsurprisingly, deletes a file. As with `PUT`, the secret token is required.
 
+```
+$ curl -XDELETE 0.0.0.0:7745/08b515d619419115 -i -H'X-Secret:32064a5fdb0ca799'
+HTTP/1.1 200 OK
+
+Deleted.
+```
+
 .
diff --git a/src/main.rs b/src/main.rs
index 15f47bc..116208e 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -318,15 +318,16 @@ impl Repository {
             Response::text("Updated OK.")
         } else {
             // INSERT
-            the_id = self.insert(data, mime, expiry.unwrap_or(self.config.default_expiry));
+            let (id, secret) = self.insert(data, mime, expiry.unwrap_or(self.config.default_expiry));
+            the_id = id;
+
             Response::text(format!("{:016x}", the_id))
+                .with_additional_header(HDR_SECRET, format!("{:016x}", secret))
         };
 
+        // add the X-Expires header to the response
         let post = self.posts.get(&the_id).unwrap();
-
-        resp
-            .with_additional_header(HDR_SECRET, format!("{:016x}", post.secret))
-            .with_additional_header(HDR_EXPIRY, post.time_remains().as_secs().to_string())
+        resp.with_additional_header(HDR_EXPIRY, post.time_remains().as_secs().to_string())
     }
 
     /// Serve a GET or HEAD request
@@ -531,7 +532,7 @@ impl Repository {
     }
 
     /// Insert a post
-    fn insert(&mut self, data: Vec<u8>, mime: Option<&str>, expires: Duration) -> PostId {
+    fn insert(&mut self, data: Vec<u8>, mime: Option<&str>, expires: Duration) -> (PostId, Secret) {
         info!(
             "Insert post with data of len {} bytes, mime {}, expiry {:?}",
             data.len(),
@@ -573,7 +574,7 @@ impl Repository {
 
         self.dirty = true;
 
-        post_id
+        (post_id, secret)
     }
 
     /// Update a post by ID