auth.js - cache-control max-age = 1yr