Yeah, setting everything in the scripts would be good.

For real good measure you could just do:

% HTTP
Cache-Control: no-cache, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
%

Cache-Control was added in http 1.1, before that there was only the very poorly thought out "pragma" and "expires" headers. You could just use Cache-Control, but it wont work for agents that only support http 1.0. Although, if all http/1.1 agents pay attention to pragma and expires, you could drop the cache-control header altogether and just use pragma, and expires, I'm not sure.