@brevilo on WordPress.org
Mentioned in [59728] on Core SVN:Posts, Post Types: Add no-cache headers to password protected posts.
Created ticket #61711 on Core Trac:Password-protected pages lacking appropriate 'Cache-Control' request header