class NoStoreHTMLMiddleware:
    """Prevent browsers and installed PWAs from retaining authenticated HTML views."""

    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        response = self.get_response(request)
        if response.get("Content-Type", "").lower().startswith("text/html"):
            response["Cache-Control"] = "private, no-cache, no-store, must-revalidate"
            response["Pragma"] = "no-cache"
            response["Expires"] = "0"
        return response