Set cache headers for unauthenticated views

[MelissaAutumn]

We're not setting any cache headers. That's less than ideal.

As a first step, create a middleware to add cache-control with some reasonable age to the response header for unauthenticated requests only.

Probably something along the lines of

if not request.user or not request.user.is_authenticated:
  response.headers['Cache-Control'] = ...