add "Cache-Control: must-revalidate" to API
set cache headers in CacheHeadersMiddleware only when ?cache querystring set
lighten our Vary headers
add dns-prefetch for CDN in commonplace template