// http://drupal.org/node/70521
// http://drupal.org/files/issues/headers-cvs-4.patch.txt

--- includes/bootstrap.inc
+++ includes/bootstrap.inc
@@ -381,6 +381,15 @@
 
 /**
  * Set HTTP headers in preparation for a page response.
+ * 
+ * The general approach here is that anonymous users can keep a local cache of
+ * the page, but must revalidate it on every request. Then, they are given a
+ * '304 Not Modified' response as long as they stay logged out and the page
+ * has not been modified.
+ * This prevents authenticated users seeing locally cached pages that show them
+ * as logged out.
+ * Authenticated users are always given a 'no-cache' header set, and will fetch
+ * a fresh page on every request.
  *
  * @see page_set_cache
  */
@@ -412,7 +421,10 @@
     // Send appropriate response:
     header("Last-Modified: $date");
     header("ETag: $etag");
-
+    // The following headers force validation of cache
+    header("Expires: Sun, 19 Nov 1978 05:00:00 GMT");
+    header("Cache-Control: must-revalidate");
+      
     // Determine if the browser accepts gzipped data.
     if (@strpos($_SERVER['HTTP_ACCEPT_ENCODING'], 'gzip') === FALSE && function_exists('gzencode')) {
       // Strip the gzip header and run uncompress.