diff --git a/apps/api/app/main.py b/apps/api/app/main.py
index f7fb7a1..9bcc98d 100644
--- a/apps/api/app/main.py
+++ b/apps/api/app/main.py
@@ -98,7 +98,7 @@ def row_json(row):
 class ApiHandler(BaseHTTPRequestHandler):
     server_version = "ProspectPlatform/0.1"
     def send_json(self, status, payload, extra_headers=None):
-        body = json.dumps(payload, sort_keys=True, default=str).encode(); self.send_response(status); self.send_header("Content-Type","application/json; charset=utf-8"); self.send_header("Access-Control-Allow-Origin",os.environ.get("CORS_ORIGINS","http://localhost:8080")); self.send_header("Access-Control-Allow-Credentials","true"); self.send_header("Access-Control-Allow-Methods","GET, POST, PATCH, OPTIONS"); self.send_header("Access-Control-Allow-Headers","Content-Type")
+        body = json.dumps(payload, sort_keys=True, default=str).encode(); self.send_response(status); self.send_header("Content-Type","application/json; charset=utf-8"); self.send_header("Cache-Control","no-store, private"); self.send_header("Pragma","no-cache"); self.send_header("Vary","Cookie, Origin"); self.send_header("Access-Control-Allow-Origin",os.environ.get("CORS_ORIGINS","http://localhost:8080")); self.send_header("Access-Control-Allow-Credentials","true"); self.send_header("Access-Control-Allow-Methods","GET, POST, PATCH, OPTIONS"); self.send_header("Access-Control-Allow-Headers","Content-Type")
         for k,v in (extra_headers or {}).items(): self.send_header(k,v)
         self.send_header("Content-Length",str(len(body))); self.end_headers(); self.wfile.write(body)
     def read_json(self):