Cleanup, more consistent use of location header in WS responses, addition of cache control to permission URLs