Feature/allow private caching

The Cache-Control setting "private" should not prevent caching in all circumstances. This PR adds the configuration option `private_cache` to allow caching when the caller is the endpoint or is handling access control.

`rake test` passes. I don't have dalli up locally but I doubt that's relevant.