Core pr 5

Fixed some user redirects and coding style.
Why is this needed?

I would think that Drupal handled setting the correct headers for not caching authenticated pages out of the box.