emit cache-control headers to not cache on the authorization page