Add `no-store` to AppFramework

core/avatar/avatarcontroller.php

@@ -209,8 +209,7 @@ class AvatarController extends Controller {
 
 		$resp = new DataDisplayResponse($image->data(),
 				Http::STATUS_OK,
-				['Content-Type' => $image->mimeType(),
-				 'Pragma' => 'public']);
+				['Content-Type' => $image->mimeType()]);
 
 		$resp->setETag(crc32($image->data()));
 		$resp->cacheFor(0);

lib/public/appframework/http/response.php

@@ -94,7 +94,7 @@ class Response {
 			$this->addHeader('Cache-Control', 'max-age=' . $cacheSeconds .
 				', must-revalidate');
 		} else {
-			$this->addHeader('Cache-Control', 'no-cache, must-revalidate');
+			$this->addHeader('Cache-Control', 'no-cache, no-store, must-revalidate');
 		}
 
 		return $this;

tests/lib/appframework/http/ResponseTest.php

@@ -221,7 +221,7 @@ class ResponseTest extends \Test\TestCase {
 		$this->childResponse->cacheFor(0);
 
 		$headers = $this->childResponse->getHeaders();
-		$this->assertEquals('no-cache, must-revalidate', $headers['Cache-Control']);
+		$this->assertEquals('no-cache, no-store, must-revalidate', $headers['Cache-Control']);
 	}