actually this `unless_role` thing feels very hacky. the only thing for which this could be relevant is max-age - all other things make no sense as caching a page that is different for some users is impossible. even for that its inconsistent. no only_if_role and no and/or lists of roles... chances imho are high that if somebody ever needs this, configuration will not be enough anyways.

i think we should remove this option, and instead have a disable method on this listener that allows application code to disable the automatic stuff for special cases, when they know they have just set precise headers and don't want no default behaviour.