in most cases, must-revalidate comes with max-age: 0, which means the resource cannot be cached at all and must always be revalidated. However, according to the standard, the revalidation only needs to be done if the response is stale (http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9.4): "When the must-revalidate directive is present in a response received by a cache, that cache MUST NOT use the entry after it becomes stale to respond to a
subsequent request without first revalidating it with the origin server."