title: Why is my Yii2 app setting cookies and Cache-Control on Heroku in production but not locally?
body: <p>Why I try to see the headers set by my app, I see that it is setting a bunch of headers in production on Heroku, but not locally. I can't find where these headers are being set. There is nothing in a <code>.htaccess</code> file to set them, and nothing in the code.</p>
  
  <h3>Locally</h3>
  
  <pre><code>$ curl -I http://localhost:81/xxxx/web/shopping/search?q=toaster
  HTTP/1.1 200 OK
  Date: Wed, 11 Nov 2015 01:42:27 GMT
  Server: Apache/2.4.16 (Unix) OpenSSL/1.0.2d PHP/5.6.12
  X-Powered-By: PHP/5.6.12
  Content-Type: text/html; charset=UTF-8
  
  $ grep cache_limiter  /etc/php5/php.ini
  session.cache_limiter = nocache
  </code></pre>
  
  <h3>Heroku</h3>
  
  <pre><code>$ curl -I http://xxxx.herokuapp.com/shopping/search?q=toaster
  HTTP/1.1 200 OK
  Connection: keep-alive
  Date: Wed, 11 Nov 2015 01:41:00 GMT
  Server: Apache/2.4.16 (Unix) OpenSSL/1.0.1f
  X-Powered-By: PHP/5.6.15
  Expires: Thu, 19 Nov 1981 08:52:00 GMT
  Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  Pragma: no-cache
  Set-Cookie: PHPSESSID=6s4ldkqggihqgb9gj2qvjcn4r0; path=/; HttpOnly
  Set-Cookie: search=2f4e7a0d06212f661972c07e76dbfa0f9e19c4db05c19e51bc48ae4652bff4b1a%3A2%3A%7Bi%3A0%3Bs%3A6%3A%22search%22%3Bi%3A1%3Bs%3A26%3A%22%2Fshopping%2Fsearch%3Fq%3Dtoaster%22%3B%7D; path=/; httponly
  Set-Cookie: _csrf=4fbe4972ee8c23b296f9673d3987cb1c4928a4bae193d411f4884e431351bdb0a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22pe67duP6CFmncROecUjq-JQvCp9-Ho4M%22%3B%7D; path=/; httponly
  Content-Type: text/html; charset=UTF-8
  Via: 1.1 vegur
  </code></pre>