I'm working with Next.js App Router and have a question about how caching works with multiple authenticated users.
Here's my setup:

async function fetchUserData() {
  const res = await fetch('https://api.example.com/user-data', {
    next: { 
      revalidate: 60,
      tags: ['user-data'] // Same tag for all users
    },
    headers: {
      'Authorization': `Bearer ${userToken}` // Different for each user
    }
  });
  
  return res.json();
}

I have around 50 users in my application. Each user has their own profile page where I call fetchUserData() to get their personal data.
I have a few questions about how Next.js handles caching in this scenario:

Cache separation: How does Next.js distinguish between different users' data in the cache? If User A and User B both access their profile pages (hitting the same endpoint but with different auth tokens) while the cache is still valid, how does Next.js ensure they each get their own data?

Cache keys: Does Next.js automatically include the Authorization header as part of the cache key? If so, does this mean I don't need to worry about data leakage between users?

Tag-based revalidation: With the setup above where all users share the same tag ('user-data'), if I call revalidateTag('user-data') when a single user updates their profile, will it revalidate the cache for all 50 users or just for that specific user?

Best practices: Should I be using user-specific tags like user-${userId} instead of a shared tag? What's the recommended approach for handling per-user cache invalidation?

I want to ensure I'm implementing this correctly to maintain data privacy while also optimizing performance.