Do not return location in headers

In some cases credentials were being leaked when downloading a cached
v1 image.

Fixes bug 1135541, CVE-2013-1840

Change-Id: Ib16ad40d3ea1c642384053be54ce029c386d7ea6