Private (or anything other than public) dashboards should not be cached

[simonw]

I noticed that a private dashboard running behind Cloudflare (on my blog) got cached in the public Cloudflare cache when I loaded it as an authenticated user - and could then be seen by logged-out users. This is bad.

[simonw]

I'll add Cache-Control: private to any dashboard that isn't public on unlisted.