Setting Expires to 0 seems to work also; I think it's in the http/1.1 RFC (RFC 2068) somewhere as an OK thing to do.

Also the following might be relevant:
Pragma = no-cache (http/1.0)
Cache-Control = no-cache (http/1.1)
(bearing in mind that proxy servers in between you and your users might be http/1.0 or http/1.1, although the 1.1 ones should be backwards compatible, presumably)

andy.