This was prompted by a bug report that we didn't properly handle the
must-revalidate directive. Indeed, we always caused a refresh
for must-revalidate. The spec says must-revalidate only takes effect
for stale responses.
I find the spec to be unclear on how to handle must-revalidate without
an explicit expiration time. Currently, if we have a response
that has must-revalidate, no expires, but the last-modified factor
rule says the reponse is fresh, then we don't force a validation.
Also added support for the max-stale request directive.
I changed some of the internal accounting to use status codes. In the
future it may be useful to have a "refresh.log" file so people can
figure out why a particular request got validated, or didn't.