Auth request: add note that proxy_cache and friends do not work. With r->header_only set upstream module will shutdown client connection in case it needs to do cache/store. Probably it's good idea to avoid setting r->header_only on auth subrequest to make cache work. On the other hand, auth subrequest then will be required to return responses with empty body in all cases, even on errors.