Make status be cache-control no-store

This fixes #2

Initially I considered private, but that means it can be cached in
the browser, but we don't want any caching, and there's way to
validate, so no-store is most explicit.