The first commit adjusts the cache key to not include the original request URI. [1] The second one tweaks how cache entries are populated and refreshed to avoid hitting archweb multiple times while entries are inserted or updated (if stale). [2]
I have tested and deployed these changes. Seems to work well!
[1] this gets us from many auth requests (1 per URL) down to a handful (however many pacman does concurrently)
[2] after this I now only notice at most one auth request per 5 minutes for both nonexistent and stale cache entries