[WIP] allow configuration to decide on cacheable status of response

Continuation of #61 
Allowing control over what is to be considered safe for adding the headers. As discussed in #35 / #33

* [ ] Also configure tag subscriber to tag and say when to invalidate or not
* [ ] Move the decide logic into separate class to reuse.
* [ ] Think about this unless_role thing.