The security implications come from the fact that old proxy might be prone to cache poisoning. Which means that an malicious request might be stored in a old proxy and this "poisoned" data is then delivered to some other client. http://webcache.googleusercontent.com/search?q=cache:http://www.ietf.org/mail-archive/web/hybi/current/msg04744.html. I *think* that the Problem is resolved with the completely new draft 06?