Do not return location in headers

In some cases credentials were being leaked when downloading a cached
v1 image.

Fixes bug 1135541, CVE-2013-1840

Change-Id: I3ec0a8f484fe1bdc32c3c56fce810fcef347a7f6