Change default "Cache Control" operation to be more robust by adding "Cache-Control: no-store, must-revalidate".  Also adding "Expires: 0" when no-store is included in the Cache-Control header directives.  These are best practices as mentioned by OWASP (https://www.owasp.org/index.php/OWASP_Application_Security_FAQ#How_do_I_ensure_that_sensitive_pages_are_not_cached_on_the_user.27s_browser.3F) and http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html