Set cache-control headers for asset API responses

Cache API responses for assets for 30 minutes,
except where the asset has not been virus-scanned,
where we set a cache-time of 0.
We don't have virus scanning yet
Merge pull request #17 from theodi/feature-fix-caching

Add sensible cache-control headers