I just went back and reread our internal documentation, we now recommend that the header be:

  Cache-Control: no-cache, no-store, max-age=0, must-revalidate

which is fairly aggressive in not caching content.  I'm fairly inclined to trust our internal documentation here, we are quite good at keeping this information current and valid across our entire product line.  And we have a rather large user base on the web.

I'm not an HTTP 1.1 expert, but it seems to me that sending multiple Cache-Control lines isn't what the standard recommends and may inadvertently break a user agent or proxy that recognizes a proper Cache-Control line.