[Fixes #76768770] Move Authorization from NoCache to Cache

Despite what the RFC says, all of our current vendors *do* cache requests
that have Authorization headers and no explicit Cache-Control headers in the
response. They are not sure why - but we've lived with this behaviour for
some time now and are happy to accept it.