Disabling client cache should be optionable

[asfaltboy]

The commit 713f918 added a decorator that sets the cache-control and expires headers to explicitly disable caching on the client.

While I can see how this may be useful in some cases, it doesn't work for my use case. I want to be able to allow a client which had an authorized user access an image, to keep accessing it for a short while after, thus I'd like to customize the cache-control's max-age and expires values to something else (perhaps something closer to what the S3 token expiry is set to).

How do you feel about allowing the header values to be customized? Or perhaps allowing users to specify the expiry time delta (in seconds?) or None (to disable cache) ? If you agree with one of these solutions, I would love to submit a pull request.

[mfxuus]

I agree - was trying to figure out what was disabling the cache (thought I mis-configured the server) and traced it back to @add_no_cache_headers. Would be nice to have this configurable.

[xjlin0]

Totally agree -- could we at least can turn it on/off so the cache is allowed? thanks!