I am almost sure you did set up this, but worth asking anyway. Was it "Cache-Control: private no-store", right?