Often I use
Cache-Control: no-cache
or
Cache-Control: max-age=0
The spec says must-revalidate is for max-stale... (the server issue max-stale?)
So if for normal web servers, Apache, or Rails with Mongrels, then I think usually there is no max-stale, so must-revalidate is not needed?