One way to do this is to ensure that all pages containing sensitive information are not
cached, and that all such pages restrict access to requests that are accompanied by an
active and authenticated session token associated with a user who has the required
permissions to access that page.