app.js: readonly mode optimisations

Send sensible Cache-Control headers when operating in readonly mode.
This also switches off any kind of cookie processing in readonly mode,
as we don't allow logins.