Re: Page expiration problem

Think first of all what your page expiry _should_ be, and then worry
afterwards about how browsers are interpreting this.

"300 sec" sounds like a bad idea. It should either be cacheable for a
long session, or it should never be cached. The page where you _enter_
the password can be cached for ages, the responses after this point
maybe should never be. I doubt you'll ever find a single set of headers
that's appropriate to send on all your pages (but with PHP you can
easily change them on a per-page basis, even more easily than with ASP)

.