don't cache responses to requests with an Authorization header