Set cache-control header to header actually used
Set cache-control header to header actually used

It doesn't make sense to set Cache-Control to include
'must-revalidate' AND 'no-store', since with private and no-store there's
nothing to revalidate. I originally set them as a belt-and-suspenders
protection mechanism, but Rails notices this & won't send must-revalidate.
It's confusing to set must-revalidate yet not actually send it.
So let's remove must-revalidate from the code, so that the code
accurately reflects what it actually being sent.

Signed-off-by: David A. Wheeler <9ae72d22d8b894b865a7a496af4fab6320e6abb2@dwheeler.com>

coreinfrastructure/best-practices-badge,coreinfrastructure/best-practices-badge,coreinfrastructure/best-practices-badge,linuxfoundation/cii-best-practices-badge,linuxfoundation/cii-best-practices-badge,linuxfoundation/cii-best-practices-badge,coreinfrastructure/best-practices-badge,linuxfoundation/cii-best-practices-badge