explicit headers to disable caching behavior in IE for /api calls - issue mozilla/123done#3

packages/123done/server.js

@@ -13,17 +13,26 @@ db.on("error", function (err) {
 
 var app = express.createServer(
   express.logger(),
-  express.bodyParser(),
-  sessions({
-    cookieName: '123done',
-    secret: process.env['COOKIE_SECRET'] || 'define a real secret, please',
-    cookie: {
-      path: '/api',
-      httpOnly: true
-    }
-  })
+  express.bodyParser()
 );
 
+app.use(function (req, res, next) {
+  if (/^\/api/.test(req.url)) {
+    res.setHeader('Cache-Control', 'no-cache, max-age=0');
+
+    return sessions({
+      cookieName: '123done',
+      secret: process.env['COOKIE_SECRET'] || 'define a real secret, please',
+      cookie: {
+        path: '/api',
+        httpOnly: true
+      }
+    })(req, res, next);
+  } else {
+    return next();
+  }
+});
+
 // a function to verify that the current user is authenticated
 function checkAuth(req, res, next) {
   if (!req.session.user) {