I have been considering some special auth support. For example, there could be rules like "if an Authentication header is identical for multiple requests, then

I have been considering some special auth support. For example, there could be rules like "if an Authentication header is identical for multiple requests, then assume it is from the same authenticated user entity without necessarily forwarding the request to the origin server again". This alone doesn't buy you anything, but it could be used as the basis of further rules such as a cache layer that caches per-user. These ideas are not totally baked but could help in reducing load to the backend servers, which falls in line with Pushpin's goals.