ACL expiration

Once the broker has requested authorization from the http endpoint for a given client-id, it will never request it again until it restarts (losing the state) or the client reconnects by itself. The result is cached for ever. Makes sense, requesting the authorization for every message would be a huge performance hit.

Nonetheless, http provides the "Cache-Control" and "Expires" headers for controlling caching. In a dynamic environment, ACLs can change quite often and it would be cumbersome to restart the broker every time. I suggest this http plugin takes into account these headers. The user could effectively control caching as needed.

Unfortunately I don't write erlang so I can't help.