There appears to be a bug in Safari and Mobile Safari where in private browsing mode it will add a 'Cache-Control': 'maxage=0' header to a request while clearing the browser cache at the same time. Express will reasonably respond with a 304 status code. This causes Safari to attempt to load the page from its empty cache, leaving the user seeing...nothing.
Bad Safari.
Jumanji is a middleware component that hacks around this issue. It's not big and it's not clever but it's got users seeing pages again.
$ npm install jumanjivar express = require('express'),
app = express(),
jumanji = require('jumanji');
app.use(jumanji);