set cache header if no auth