merging cache headers instead of overwriting them all

fix #75 

please review thoroughly. the tests think its ok, but i am not sure if i thought about every possible situation.
for whatever reason, cache-control can have either the `private` or the `public` keyword. if the existing cache headers already have one of them, we need to unset the other, or we end up switching public to private or vice versa. if you have an idea how to make this more readable, please tell.

if you did not set anything, the headers contain neither public nor private.