Set cache-control headers for asset API responses

Cache API responses for assets for 30 minutes, except where the asset has not been virus-scanned, where we set a cache-time of 0.