Fix contradictory cache headers on every response in core/mvc.asp

Response.ExpiresAbsolute was set to a far-future date at the same time as
Cache-Control: no-cache - contradictory directives that could let a cache
serve a stale copy of dynamic, session-tied content. Also, Response.AddHeader
"cache-control", ... doesn't affect the separate Response.CacheControl
intrinsic property (which defaults to "private" and was still being sent
regardless of AddHeader); set the property directly so the header is
actually correct on the wire.

Found while diagnosing a "Your form session expired" report that turned out
to be caused by something else (a server-side permissions issue), but this
is a real, independent correctness bug worth fixing regardless.

core/mvc.asp

@@ -1,11 +1,18 @@
 <!--#include file="../app/Controllers/autoload_controllers.asp" -->
 <%
-' Set cache expiration from configuration
-Dim cacheYear : cacheYear = GetAppSetting("CacheExpirationYear")
-If cacheYear = "nothing" Then cacheYear = "2030"
-Response.ExpiresAbsolute = "01/01/" & cacheYear
+' Every response is dynamic and session-sensitive (CSRF tokens, flash messages), so tell
+' every cache - browser, proxy, or antivirus web filter - not to store it at all.
+'
+' Response.CacheControl is ASP's intrinsic property that actually governs the real
+' Cache-Control header IIS sends, and it defaults to "private" (which explicitly PERMITS
+' browser-local caching) if never set. Response.AddHeader "cache-control", ... does NOT
+' touch that property - it adds a second, separate Cache-Control header alongside it, which
+' a real proxy/cache can parse unpredictably (confirmed via debug logging: a response still
+' reported Response.CacheControl = "private" even after AddHeader was called). Must set the
+' CacheControl property directly for this to actually take effect.
+Response.ExpiresAbsolute = Now() - 1
+Response.CacheControl = "no-cache"
 Response.AddHeader "pragma", "no-cache"
-Response.AddHeader "cache-control", "private, no-cache, must-revalidate"
 '=======================================================================================================================
 ' MVC Dispatcher
 '=======================================================================================================================