Max age should be available for SHA as package version

Version tag, SHA ref, should have appropriate cache control set for response header.