user can add must-revalidate directive to responses

[a-luna]

similarly to #51, this should be configurable at a global level and also at each endpoint which overrides the global setting.