`mozorg.middleware.CacheMiddleware` adds Expires and Cache-Control for 10 minutes after access. This seems to prevent apache from overriding with whatever we set there. The middleware doesn't add if Cache-Control is already set, so this seems to be the best/easiest way to get this working. But I agree with you in general.