Disable cache on base url for redirecting unauthenticated users
Not Drupal specific, but you should use the status code 302. Redirects with a status code 301 are cached very aggressively by browsers.

In Drupal custom code, never send a response directly, set it in the event, so that it can be returned and cached properly by Drupal, which is by the way not a bad thing, because the page cache can handle different cached versions for authenticated and anonymous users:

$event-&gt;setResponse($response);