Do not add "Cache-Control: no-cache" to header when publishing web through WAF with form autentication. It was discussed in support ticket #9847958:
"According to the development team, Header "Cache-Control: no-cache" is set by reverse proxy for pages protected by reverse form authentication. This is necessary because requesting protected pages must be checked against the origin server."

When publishing web with no autentication or with basic authentication, it is OK and no caching is affected.
All webs published with form auth are extremly slow because all requested items (jpg, css, script, ...) are transfered from XG every time user clicks or refresh. It is useless.