Improve browser caching: add max-age directive

Right now, we're just sending a `public` Cache-Control directive. Google suggests:

> It is important to specify one of Expires or Cache-Control max-age, and one of Last-Modified or ETag, for all cacheable resources. It is redundant to specify both Expires and Cache-Control: max-age, or to specify both Last-Modified and ETag. 
 - https://developers.google.com/speed/docs/best-practices/caching?csw=1#LeverageBrowserCaching

This PR implements a Cache-Control max-age directive.