I understand the prime of challenge/response protocol. Failing the first request looks fine as long as it occurs only once and not for every page you visit. I wonder if administrators would be happy with the fact that users have to send 2 requests to fetch an object, 40% of times on a browser that's been open for the whole day. Could I blame the browser for not learning how it should talk the proxy? Apart from the waste of bandwidth (although negligible), the other problem is that logs will be cluttered and full of garbage which also makes access/usage statistics inaccurate.