headers: pass through no-store; don't duplicate cache-control