Add cache-control and vary headers

Add a `Vary: Cookie` header to all responses to allow for session-based
differences in content. Add `Cache-Control:private, must-revalidate,
max-age=0` and an `Expires` header in the past to all responses for
authenticated users to force clients to check with the server on every
request.

Bug: 58678
Change-Id: I499d68e5df3ea35a548e3d3aa1141f3b9b79281c