persistent data about repositories should be in cachedir.

so even the regular users can expire their own metadata.