[fix] correct headers for __data.js requests

[dummdidumm]

Add all headers except cache-control which is always no-store
Fixes #6458
Fixes (?) #6477 <- not sure how to best handle this, conflicting requirements here

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

• It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs
• This message body should clearly illustrate what problems it solves.
• Ideally, include a test that fails without this PR but passes with it.

Tests

• Run the tests with pnpm test and lint the project with pnpm lint and pnpm check

Changesets

• If your PR makes a change that should be noted in one or more packages' changelogs, generate a changeset by running pnpm changeset and following the prompts. All changesets should be patch until SvelteKit 1.0

[changeset-bot]

🦋 Changeset detected

Latest commit: 81608b5

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@sveltejs/kit	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[Rich-Harris]

I'm not sure we want to add headers other than set-cookie? There's no way for the application to access them so they're useless at best (except set-cookie and cache-control, which have side-effects).

Given that some platforms sometimes apparently apply default cache-control headers if none are provided, and given that the __id parameter is per-user, I think we need to always apply private, no-store. If we respect max-age and s-maxage it should probably be in the form of a window.__sveltekit_data_ttl value or similar, the same way we cache data inlined into the HTML response.

[dummdidumm]

I'm not well-versed with all the possibilities of headers, but in #6477 on comment asked for setting headers besides the cache-control - don't know if that's sensible.

[homerjam]

not rerunning them is ensured differently

So is there another way to ensure data requests are not re-run "unnecessarily" ie. if I don't need fresh data (I was using cache-control header in load before "pluskit")?

Is window.__sveltekit_data_ttl documented somewhere?

[Rich-Harris]

on comment asked for setting headers besides the cache-control - don't know if that's sensible

Those sec-fetch-mode and sec-fetch-dest headers would have no effect

Is window.__sveltekit_data_ttl documented somewhere?

No, it doesn't exist. If we do implement it, it'll be an internal detail, not something you'd need to be aware of

[dummdidumm]

Closing as obsolete - the no-store part was implemented in another PR and the cache will need a different implementation.