Cache control response headers exists but authentication is performed

[emmanuelgautier]

Cache control response header public should not be set when an authentication is performed. It increase risk to put not shareable (personal, confidential, ...) data into a shared cache.

Cache-Control directives documentation