An attempt at conservative default cache-control headers

[jonasfj]

public max-age=10min for all responses where:

• Request is GET
• Response is HTML
• Response is 200
• Request has no authentication, xsrf-token or cookies
• Response handler didn't explicitly set a different Cache-Control header

public max-age=30min for all responses where:

• Request is GET
• Request is handled by PubApi (ie. this is /api/)
• Response is 200
• Request has no authentication, xsrf-token or cookies
• Response handler didn't explicitly set a different Cache-Control header

Also made a few exceptions:

• set private on responses for /consent flow.
• set public max-age=10min on screenshots
• set public max-age=10min on version listing API /api/packages/<package>

[isoos]

public max-age=30min

shouldn't we start with a lower default and increase it in a subsequent deployment?