If the first piece of a partial resource is in cache and unexpired, we will happily hand it to the users first, and then go try get the rest. If the validation for that fails we are stuck, since the portion already delivered can't be glued together with the rest.

We could either have more sophisticated control flow, where we can wait on handling the cache bits until the first non-cache bits is validated, or try to re-validate the in-cache prefix, at cost of potentially sending 
extra requests.

See also  bug 888742  for a special case.