may concern with defaulting to cache = TRUE, is that with improper validation there might be access issues. For example, if a permission was changed we don't invalidate, and that's fine, because RESTful can't and doesn't need to take care of all the scenarios.