Add support for HTTP caching of the session token resource

Make it possible to configure the Crowd server to serve a customisable Cache-Control header with the session token resource, i.e., the response to these two operations:

• GET /session/$token: returns the user who owns the token
• POST /session/$token: validates the token and extends its lifetime