What is the proper way to tell the browser not to cache?

<meta http-equiv="Cache-Control" content="private, no-store" />

Is really ALL you need, as stated here https://youtu.be/TNlcoYLIGFk?t=654 by Andrew Betts, elected W3C TAG member.

Using this, you will not need pragma or expires. Infact, the above will overwrite the Expires command.

You want to send an Expires header set to a date in the past (like your Meta tag).

Expires is the most widely respected cache header, but you can also use things like Last-Modified, or Etags to get more specific control.

Meta tags are a somewhat outdated means of setting caching protocols, and most of the meta cache control properties are fairly deprecated (e.g. NO-CACHE). A lot of user agents ignore them.

This should help you:

<meta http-equiv="cache-control" content="no-cache" />

You can also configure the static content cache mechanism through IIS; you can learn how to do so here: http://support.microsoft.com/kb/247404.

Send your expires headers using your server. Specifically, if you're using apache, look at this:

http://httpd.apache.org/docs/2.0/mod/mod_expires.html