Move Vary headers and Last-Modified out of the public API.

These fields and behaviors are needed for HTTP caching. If we want
to expose certain headers to the application layer, we should do it
more thoughtfully.