Treat no-cache as must-revalidate in Authentication

Treat no-cache as must-revalidate in Authentication

Wrapped as a violation because this operation is off-spec.

CC:no-cache was omitted from the HTTP spec apparently on grounds that
changing its caching effects on authentication would come as a surprise.
The actual operation is safe enough to use when parameterless no-cache
is treated strictly as an alias for must-revalidate (as done by Squid now).

Ref: http://lists.w3.org/Archives/Public/ietf-http-wg/2012OctDec/0387.html