slightly better cache-control

This also makes the default max-age configurable via: ``SEND_FILE_MAX_AGE_DEFAULT`` in ``config.yaml``.

Also read full commit message.