Improve setting of cache-control headers.

This adds an explicit "public" to the cache-control headers in most cases (when serving draft artefacts, it's set to "private").  This is to ensure that Rack::Cache will always cache the response.  Without this, it won't cache the response if the request contains a cookies or Authorization header (see the "private_headers" option in http://rtomayko.github.io/rack-cache/configuration).

I've also added cache-control headers to several endpoints that where missing them.