This is since this commit: cf4eb46

Because of this change the Cache-Control header is sent always. As far as I know the session.cache_limiter off state is '' and not '0'.
http://php.net/manual/en/function.session-cache-limiter.php