return no-cache on 404

[taoeffect]

Partially addresses #2608.

[cypress]

group-income    Run #3928

Run Properties:   Passed #3928  •  c2335d374a ℹ️: Merge a44b1e93d1ec00156919df11420137f79c5672fb into 4680441e5ef89a418159ac9941a9...

Project	group-income
Branch Review	2608-disable-cache-404
Run status	Passed #3928
Run duration	11m 34s
Commit	c2335d374a ℹ️: Merge a44b1e93d1ec00156919df11420137f79c5672fb into 4680441e5ef89a418159ac9941a9...
Committer	Greg Slepak
View all properties for this run ↗︎

---

Test results
Failures	0
Flaky	0
Pending	10
Skipped	0
Passing	114
View all changes introduced in this branch ↗︎

[corrideat]

*-revalidate is redundant as well, since no-store already means that the response should not be put in a cache to begin with.

[corrideat]

Also, I think the issue here is this, since by default 404 responses will not be cached.

Most commonly, caches store the successful result of a retrieval request: i.e., a 200 (OK) response to a GET request, which contains a representation of the target resource (Section 9.3.1 of [HTTP]). However, it is also possible to store redirects, negative results (e.g., 404 (Not Found)), incomplete results (e.g., 206 (Partial Content)), and responses to methods other than GET if the method's definition allows such caching and defines something suitable for use as a cache key.

  cache: {
    // Do not set other cache options here, to make sure the 'otherwise' option
    // will be used so that the 'immutable' directive gets included.
    otherwise: 'public,max-age=31536000,immutable'
  }

I'm not too familiar with HAPI, and not with the old version used in GI, but, instead of setting a cache policy and then 'undoing it' with this new notFoundNoCache wouldn't it be better to simply tell HAPI not to apply the immutable (or a custom) cache policy to errors?

[corrideat]

Expires is supposed to have a timestamp, so 0 isn't a valid value. However, it's not really relevant if cache-control is present, except for clients that don't support HTTP/1.1. I don't think any such clients exist (today) to any significant, and even if they did, they can be ignored.

[corrideat]

Pragma: no-cache has never been standard for responses, and is also largely irrelevant for clients that understand cache-control.

[corrideat]

I suggest either of these solutions:

1. Set cache-control: immutable,... only for successful responses. From the HAPI docs, it seems like removing the cache: otherwise option would do this, plus adding the header to the response. This requires no additional changes because 404, etc. isn't supposed to be cached unless it says it should.
2. Leave things mostly are they currently are, but on 404 return only cache-control: no-store without pragma or expires.