SecurityRealm captcha should use no-store as well as no cache in cache-control

looking at the code I think that the no-store option should be used in addition to the no-cache.

as navigating back or resubmitting the data will likely lead to an out of date captcha.