HttpListener should pay attention to extended attributes when caching context

[wfurt]

In some cases like NTLM we have connection based authentication but we have delegate that can select expected protection level per request. This is design disconnect but we should verify that the connection auth has expect attributes or fail.

[dotnet-policy-service]

Tagging subscribers to this area: @karelz, @dotnet/ncl
See info in area-owners.md if you want to be subscribed.