Fix bug 8138: server cache-control (#8141)

* cache-control no-store by default

* clarify comment spec reference

* comment typo

* fix else formatting

* Update server.js

allow route definitions to set their own cache-control

core/modules/server/server.js

@@ -140,6 +140,11 @@ function sendResponse(request,response,statusCode,headers,data,encoding) {
 				return;
 			}
 		}
+	} else {
+		// RFC 7231, 6.1. Overview of Status Codes:
+		// Browser clients may cache 200, 203, 204, 206, 300, 301, 
+		// 404, 405, 410, 414, and 501 unless given explicit cache controls
+		headers["Cache-Control"] = headers["Cache-Control"] || "no-store";
 	}
 	/*
 	If the gzip=yes is set, check if the user agent permits compression. If so,