REST API does not send nocache headers on authenticated requests

[joehoyle]

Core typically sends nocache headers on all auth'ed responses, as in wp, admin-ajax, etc. Because the REST API infrastructure is hooked in pre-wp, we should be setting this ourselves.

I'd recommend we get this fix in 4.4 given the implications.

[markjaquith]

What are the criteria? Should it be done via a hook, so it can be unhooked?

[joehoyle]

@markjaquith the criterium is is_user_logged_in(). I think we'll need to add it directly, but can pass it through a filter to allow overriding (and also sending no-cache headers on un'authed requests if the developer wanted to). Patch incoming.

[rachelbaker]

+1

[wonderboymusic]

+1 from me

[boonebgorges]

+1

[wonderboymusic]

In 35773:

REST API: Core typically sends nocache headers on all auth'ed responses, as in wp, admin-ajax, etc. Because the REST API infrastructure is hooked in pre-wp, we should be setting this ourselves.

Adds unit tests.

Props joehoyle.
Fixes #34832.