Using the expires header is not always sufficient, if only because of clients that have their clock set wrong. I have had good results with the following headers, which is what the Apache API r->no_cache emits:

Cache-Control: no-cache
Pragma: no-cache
[download]

in combination with the <code>expires now<code> header you already send out.