Set cache control headers in POST /token response

The example request in [OAuth 2.0 Device Profile, section 1.4](http://tools.ietf.org/html/draft-recordon-oauth-v2-device-00#section-1.4) spec shows a `Cache-Control: no-store` header in the response. This change adds this to our implementation.