Default page headers should be configurable

A security audit of a site complained about anti-caching headers. Some browsers and proxies 'ignore' the no-cache setting and do store some responses. These stored responses could then be read without permission.
The proposed solution was to add a 'no-store' to the caching. Easiest way was to change the default cache-control headers in drupal_page_header().

I'll add a patch that provides a variable with a default for the default page headers. Should give no backwards-compatible problems.