Arsen Rabinovich: Both, no need to allocate crawl budgets to pages you don`t want indexed in the first place.
Nick Wilsdon: BTW quick reason for this is that you need the bots to crawl the page, to set the noindex in the first place. If you nofollow, they can never read your directives. (This is incorrect, sorry Chase Reiner - see my comment below)
Steve Wiideman: Noindex should be fine. I`m not at all a fan of using nofollow on my own pages when Google`s essentially told us on many occasions that we do not need to nofollow our own content.
Jim Munro: I`m not sure that the nofollow attribute will prevent googlebot from crawling or reading the noindex, Nick Wilsdon. I think nofollow only means "don`t follow the links on this page"
Alan Bleiweiss: And for the love of all that is good, and holy, please ensure no self-pointing canonical tags exist on those pages.
Alan Bleiweiss: And it can`t hurt to put nofollow on links pointing to those pages, because, as Arsen mentions, crawl efficiency.
William Atchison: Just be careful what you block or nofollow and use only under adult supervision.
Neither the neta tags nor nofollow actually stop crawlers. It`s complicated, but while nofollow should stop a crawl it really doesn`t as Google wants to know everything, but keeps things out of the index. However, if others link or share something you have set to nofollow, game over, it`s indexed.
Pages you really don`t want to appear in the index should be set to meta NOINDEX
If you want to actually stop crawlers from certain pages you use robots.txt but even that doesn`t 100% stop crawlers if others have links to the page.
If you REALLY want to stop crawlers from certain pages use the Apache .htaccess file and block it from crawlers.
Nofollow mostly means that you`re not ENDORSING that link which should be used to discriminate between trusted and non trusted links.
I know people use nofollow trying to direct Google which pages are more important, but Google does a pretty good job of that on their own.
Besides, why would you want to tell google DO NOT TRUST a page on your own site? IMO not clever as typically all people do is end up confusing Google and screwing up the Google crawler by trying to be cute controlling the crawl and since you`ve told it those pages aren`t important it just stops crawling and often doesn`t crawl as deep as you want.
Doesn`t matter as people will follow bad advice from people that guess at how crawlers work that don`t really understand it and typically come crying that they can`t get things indexed.
Woo commerce cart pages or account pages. Should you noindex, no follow? Or is noindex fine? 
