fix(demo): keep OAuth token responses uncacheable in development (#11742)

demo/nextjs/app/api/auth/[...all]/route.ts

@@ -18,10 +18,7 @@ function addCorsHeaders(url: URL, headers: Headers) {
 		);
 		headers.set("Access-Control-Allow-Origin", "*");
 		headers.set("Access-Control-Allow-Headers", "authorization, content-type");
-		headers.set(
-			"Cache-Control",
-			"public, max-age=15, stale-while-revalidate=15, stale-if-error=86400",
-		);
+		// Leave Cache-Control to the library: token responses must be no-store (RFC 6749 §5.1).
 	}
 }