Don't add CSRF tokens to responses that set cache headers

Adding CSRF tokens to cached responses could lead to users sharing CSRF
tokens if the Play instance is behind a caching proxy, like a CDN.

In this change, a response is determined to be cached if it has a
`Cache-Control` header that does not contain `no-cache`.