perf: HTTP caching headers for /api/query_results [fixes #228]

In what cases we don't have `retrieved_at`? Feels like this is masking a bug, rather something really needed.