Override default cache headers to protect against DDOS

[cjyabraham]

As per #729

PR dev instance

Cache headers set when user is not logged in:

Cache-Control: public, max-age=60, s-maxage=43200, stale-while-revalidate=86400, stale-if-error=604800

Since Pantheon cache gets cleared on a page-by-page basis when a page is updated, I have pushed s-maxage to half a day.

We should observe how the cache hit rate changes after merge and make sure all assets are being properly cached which they don't seem to be on these dev instances. Also we should re-run pagespeed.

Do before/after testing on all file types to make sure all of them are being cached properly.

[cjyabraham]

Before Condition

Pagespeed Mobile and Desktop

Currently caching all these file types

• document
• js
• css
• images
• video

[cjyabraham]

After deployment there was no change in pagespeed scores or the cacheing of secondary page assets. Just the page headers for the main document have been changed, as desired. We should wait a few weeks to assess the cache hit ratio changes.

[cjyabraham]

Cache hit ratio is basically unchanged (apart from the weird drop on June 28):