Bug 10016: force zero browser-side caching of SCO pages

This patch makes the web-based self-check module pages
specify that no browser (or proxy caching) occur at all.
This prevents a security issue where letting the SCO session time out,
then hitting the back button allowed one to view the previous
patron's session.

This patch adds an optional fifth parameter to output_with_http_headers(),
and output_html_with_http_headers(), a hashref for miscellaneous
options.  One key is defined at the moment: force_no_caching, which if
if present and set to a true value, sets HTTP headers to specify no
browser caching of the page at all.

To test:

[1] Start a web-based self-check session and optionally perform
    some transactions.
[2] Allow the session to time out (it may be helpful to set
    SelfCheckTimeout to a low value such as 10 seconds).
[3] Hit the back button.  You should not see the previous patron's
    self-check session.
[4] Verify that prove -v t/Output.t passes.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Ed Veal <ed.veal@bywatersolutions.com>
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
bug 10016: munge history in SCO to discourage resubmitting user login

This patch uses history.replaceState (introduced in HTML5) to manipulate
the browser history to encourage returning to the SCO patron barcode
form if the back button is used.

Note that a side effect of this patch is that if the user uses
the help link, they will be prompted to enter their barcode
again.  It may be better to put the help inline with the rest
of the SCO forms.

To test:

[1] Start a web-based self-check session.
[2] Enter a patron barcode.
[3] Allow the self-check session to time out.
[4] Use the back button.  You should get the patron barcode
    entry form; you should not be prompted to resubmit form input.
[5] Enter a patron barcode, perform some transactions, then
    use the finish button.
[6] Next, use the back button.  You should get the patron barcode
    entry form.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Ed Veal <ed.veal@bywatersolutions.com>
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>