PHP is overriding your caching settings, that "Expires" date is very specific and included in the PHP source code. According to this stack overflow answer, it is the developer's birthday.
You can turn this off by changing the session.cache-limiter setting in your php.ini. The session_cache_limiter function page has more information about the possible values to set here. Try setting the value to public or to nothing and testing again.
You can see what the current value of the session.cache_limiter setting is with a small test page which echos the value:
<?php
echo(ini_get('session.cache_limiter'));
You said you are looking for a PHP solution, since you cannot edit host settings. You can change the value inside your code using the ini_set function.