Thanks for pointing that out. I just opened up a ticket for it: http://code.djangoproject.com/ticket/7364

I did up a quick diff for the ticket, I ended up using the @never_cache decorator. I put the changes live on StartupIndex.ca, and it seems to be working.

Since recently, the caching also respects setting a custom max-age header, the contrib.auth login view could just use the decorator @cache_control(max_age=0)
(as explained in http://www.djangoproject.com/documentation/cache/#controlling-cache-using-other-headers)