Add no-cache, no-store if a response is private (see #1389).

src/Resources/contao/classes/FrontendTemplate.php

@@ -374,15 +374,21 @@ private function setCacheHeaders(Response $response)
 		/** @var $objPage \PageModel */
 		global $objPage;
 
-		if (($objPage->cache === false || $objPage->cache === 0) && ($objPage->clientCache === false || $objPage->clientCache === 0))
+		if (($objPage->cache === false || $objPage->cache < 1) && ($objPage->clientCache === false || $objPage->clientCache < 1))
 		{
+			$response->headers->addCacheControlDirective('no-cache');
+			$response->headers->addCacheControlDirective('no-store');
+
 			return $response->setPrivate();
 		}
 
 		// Do not cache the response if a user is logged in or the page is protected
 		// TODO: Add support for proxies so they can vary on member context
 		if (FE_USER_LOGGED_IN === true || BE_USER_LOGGED_IN === true || $objPage->protected || $this->hasAuthenticatedBackendUser())
 		{
+			$response->headers->addCacheControlDirective('no-cache');
+			$response->headers->addCacheControlDirective('no-store');
+
 			return $response->setPrivate();
 		}