Response.ExpiresAbsolute was set to a far-future date at the same time as
Cache-Control: no-cache - contradictory directives that could let a cache
serve a stale copy of dynamic, session-tied content. Also, Response.AddHeader
"cache-control", ... doesn't affect the separate Response.CacheControl
intrinsic property (which defaults to "private" and was still being sent
regardless of AddHeader); set the property directly so the header is
actually correct on the wire.

Found while diagnosing a "Your form session expired" report that turned out
to be caused by something else (a server-side permissions issue), but this
is a real, independent correctness bug worth fixing regardless.

RouteKit Classic ASP MVC starter for the Purple Envelope election-materials
order site: request-order flow, token-based order continuation, SurveyJS
order-details form with server-side validation and a themed confirmation
email, plus the framework core, generators, and dev-only aspunit test harness.