s3: cache control headers and cloudfront cache invalidation