diff --git a/mfr/server/handlers/core.py b/mfr/server/handlers/core.py
index a8fc1324..3375f3e1 100644
--- a/mfr/server/handlers/core.py
+++ b/mfr/server/handlers/core.py
@@ -47,12 +47,6 @@ def _cross_origin_is_allowed(self):
         return False
 
     def set_default_headers(self):
-        # Always disable caching, even when no ``Origin`` header is present (e.g. a plain
-        # ``<iframe src="...">`` navigation). Without this, responses carry no caching
-        # directive at all in that case, leaving any intermediary (CDN, proxy, browser) free
-        # to apply its own heuristic caching to a render response.
-        self.set_header('Cache-control', 'no-store, no-cache, must-revalidate, max-age=0')
-
         if not self.request.headers.get('Origin'):
             return
 
@@ -76,6 +70,7 @@ def set_default_headers(self):
         self.set_header('Access-Control-Allow-Credentials', 'true')
         self.set_header('Access-Control-Allow-Headers', ', '.join(CORS_ACCEPT_HEADERS))
         self.set_header('Access-Control-Expose-Headers', ', '.join(CORS_EXPOSE_HEADERS))
+        self.set_header('Cache-control', 'no-store, no-cache, must-revalidate, max-age=0')
 
     def options(self):
         self.set_status(204)
diff --git a/tests/server/handlers/test_cors.py b/tests/server/handlers/test_cors.py
index 8f7974b5..5f2b245f 100644
--- a/tests/server/handlers/test_cors.py
+++ b/tests/server/handlers/test_cors.py
@@ -166,12 +166,3 @@ def test_no_origin_means_no_cors(self):
             assert 'Access-Control-Allow-Credentials' not in self.handler.headers
             assert 'Access-Control-Allow-Headers' not in self.handler.headers
             assert 'Access-Control-Expose-Headers' not in self.handler.headers
-
-    @testing.gen_test
-    def test_no_origin_still_disables_caching(self):
-        for method in ('OPTIONS', 'HEAD' 'GET', 'POST', 'PUT', 'PATCH', 'DELETE'):
-            self.handler.request = MockRequest(
-                method=method,
-            )
-            self.handler.set_default_headers()
-            assert self.handler.headers['Cache-control'] == 'no-store, no-cache, must-revalidate, max-age=0'