The cache control header \"no-cache, must-revalidate, private\" allows browsers to cache the resource but forces a revalidate with conditional requests. This works as expect
$last_modified = filemtime($_SERVER['SCRIPT_FILENAME']);
session_cache_limiter(FALSE);
header("Content-Type: text/css");
header("Cache-Control: max-age=1, must-revalidate, private");
header("Last-Modified: " . gmdate("D, d M Y H:i:s", $last_modified) . " GMT");
if(isset($_SERVER["HTTP_IF_MODIFIED_SINCE"]))
{
if(strtotime($_SERVER["HTTP_IF_MODIFIED_SINCE"]) >= $last_modified)
{
header("HTTP/1.1 304 Not Modified");
exit;
}
}