title: NoStore is not setting Cache-Control to no-store
body: <p>We have used <code>[ResponseCache(NoStore = true)]</code> on our <code>AccountController.Login</code> action. </p>
  
  <pre><code>[HttpGet]
  [ResponseCache(NoStore = true)]
  [AllowAnonymous]
  public IActionResult Login(string returnUrl = null)
  {
      ViewData["ReturnUrl"] = returnUrl;
      return View();
  }
  </code></pre>
  
  <p>According to the documentation: </p>
  
  <blockquote>
    <p><code>NoStore</code> overrides most of the other properties. When this property is set to <code>true</code>, the <code>Cache-Control</code> header will be set to <code>"no-store"</code>.</p>
  </blockquote>
  
  <p>In a new private Firefox window, when we navigate to <code>~/Account/Login</code>, we receive the following response headers. </p>
  
  <pre><code>Cache-Control:"no-cache"
  Content-Type:"text/html; charset=utf-8"
  Date:"Mon, 26 Dec 2016 21:50:27 GMT"
  Pragma:"no-cache"
  Server:"Kestrel"
  Transfer-Encoding:"chunked"
  </code></pre>
  
  <p>We are using ASP.NET Core 1.1.0. How do we set the <code>Cache-Control</code> header to <code>no-store</code>? </p>