diff --git a/core/mvc.asp b/core/mvc.asp
index 0bbf373..69e81e7 100644
--- a/core/mvc.asp
+++ b/core/mvc.asp
@@ -1,11 +1,18 @@
 <!--#include file="../app/Controllers/autoload_controllers.asp" -->
 <%
-' Set cache expiration from configuration
-Dim cacheYear : cacheYear = GetAppSetting("CacheExpirationYear")
-If cacheYear = "nothing" Then cacheYear = "2030"
-Response.ExpiresAbsolute = "01/01/" & cacheYear
+' Every response is dynamic and session-sensitive (CSRF tokens, flash messages), so tell
+' every cache - browser, proxy, or antivirus web filter - not to store it at all.
+'
+' Response.CacheControl is ASP's intrinsic property that actually governs the real
+' Cache-Control header IIS sends, and it defaults to "private" (which explicitly PERMITS
+' browser-local caching) if never set. Response.AddHeader "cache-control", ... does NOT
+' touch that property - it adds a second, separate Cache-Control header alongside it, which
+' a real proxy/cache can parse unpredictably (confirmed via debug logging: a response still
+' reported Response.CacheControl = "private" even after AddHeader was called). Must set the
+' CacheControl property directly for this to actually take effect.
+Response.ExpiresAbsolute = Now() - 1
+Response.CacheControl = "no-cache"
 Response.AddHeader "pragma", "no-cache"
-Response.AddHeader "cache-control", "private, no-cache, must-revalidate"
 '=======================================================================================================================
 ' MVC Dispatcher
 '=======================================================================================================================
diff --git a/db/webdata.accdb b/db/webdata.accdb
index f704df0..43def5c 100644
Binary files a/db/webdata.accdb and b/db/webdata.accdb differ