Do not return location in headers

In some cases credentials were being leaked when downloading a cached
v1 image.

Fixes bug 1135541, CVE-2013-1840

Change-Id: Ie4077470d31249c5bd654985fcef577f4f5cfc59