Set appropriate cached headers

[donaldgray]

Set appropriate caching headers. In testing some intermediates are caching responses as there are no no-cache set. Confirm which endpoints should never be cached and ensure the appropriate headers are set. e.g. the gesture page shouldn't be cached as it contains a single used token.