We intend to implment "must-revalidate", "proxy-revalidate",
"max-age", and "s-maxage" the same if credentials are present; that
is, _always_ revalidate, using the current credentials.
I believe that this is a compliant implementation of the spec.
-Jeff