Allow Date and Expires headers to be overridden

Also disallow Server header to be set by handlers.