Landing page scanner validation of cache control headers is broken

[eloquence]

The landing page scanner validates several cache control header values, see https://github.com/freedomofpress/securedrop.org/blob/master/scanner/scanner.py#L309

However, the detailed values are not correctly validated; methods like validate_nocache will return False in most real-world cases. I suspect this is due to a naive validation of the header:

def validate_security_header(page, header, expected_value):
    if header not in page.headers:
        return False
    elif page.headers[header] == expected_value:
        return True
    else:
        return False

Note that the naive comparison expects a direct match of header to value, whereas the actual expected value is max-age=0, no-cache, no-store, must-revalidate. All of the detail checks therefore fail when the header is set to the recommended value.