Cache-control header missing private/public setting

Currently the default 'cache-control' header (for binaries) only contains the 'max-age' setting, and doesn't say anything about private/public.
Omitting the private/public setting will make certain CDNs act if it's a private resource, thus not caching it.

We should add the 'public' setting to the header for any binaries which should be publicly available, and set to private for others (or document how to overwrite this for specific resources).