PR #25583 and #25699 overwrites cache-control even if i manually set them to public. This breaks compatibility. version 3.4.2 works.

I use varnish to cache and have several actions with explicit @Cache annotation to cache them by varnish, regardless if the user is logged in or not. This worked since 2.7 and till 3.4.2.

With the PR #25583 this broke, but was relatively easy to fix by overwriting the savesession listener.
With #25699 the change got moved to the abstract class which makes it even harder to overwrite.
Probably by modifying the session object but still, in my opinion its a BC Break.