Set cache-control private for previews

We already set appropriate cache-control headers for [attachments](https://github.com/alphagov/whitehall/blob/master/app/controllers/attachments_controller.rb#L53) and [HTML attachments](https://github.com/alphagov/whitehall/blob/master/app/controllers/html_attachments_controller.rb#L15).

Fixes https://www.pivotaltracker.com/story/show/63957740