On requests such as http://musicbrainz.org/ws/2/release/ed562300-1963-49d4-8522-1746a6e8ab35?inc=collections no private collections are included, even if you send an authorization header. Adding an include which requires authorization (like user-tags) does make the private collections appear.

curl command line examples:

curl --digest -u Mineo "http://musicbrainz.org/ws/2/release/ed562300-1963-49d4-8522-1746a6e8ab35?inc=collections+user-tags" "http://musicbrainz.org/ws/2/release/ed562300-1963-49d4-8522-1746a6e8ab35?inc=collections" -v

The reply to the first request does list the private collection the release is in, the second one (which uses the same connection and includes an authorization header) does not list the private collection.

I think either the server should respect the Authorization header of the second request or (this solution is more in line with the already existing includes) there should be a "user-collections" include.