http caching tweaks

- no longer tell browsers they can cache static files when not in dev mode,
  not worth risking their using stale copies
- decrease expire time of cached copies of profile photos from 4 days to 1