Include Cache-Control and Pragma headers in token exchange response example

[barnabywalters]

According to https://www.rfc-editor.org/rfc/rfc6749#section-5.1, token exchange responses MUST contain the following headers

Cache-Control: no-store
Pragma: no-cache

Consider adding these to https://indieauth.spec.indieweb.org/#example-12 to make it more likely that people implementing IndieAuth servers based purely on the IndieAuth spec include them

[sknebel]

good idea, definitively do that IMHO

[barnabywalters]

Looks like it might be better to reduce this to only Cache-control: no-store, as while Pragma is required for OAuth 2.0, it’s dropped in 2.1 due to its behaviour being undefined (https://github.com/Taproot/indieauth/issues/22)