Set headers to prevent caching in webui

Fixes opscode/chef#1757.

* OWASP reference: https://www.owasp.org/index.php/Testing_for_Browser_cache_weakness_(OTG-AUTHN-006)
* HTTP RFC describing these fields: http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9

Note that the response may have multiple `Cache-Control` headers, but that's OK according to the spec and their values are merged when being interpreted by the client.