app cache manifest should be public

As a rule of thumb, as of today, if you don't want trouble, make your HTML5 application cache manifest publicly accessible.