Set cache-control with must-revalidate

so that the proxy servers get a little less aggressive