Lack of Cache-control header on /api routes requires "cache-busting" on clients

1. The `/api/contents` route (and some other `/api` routes) _do not_ include a Cache-control header in their response.
2. They _do_ include a Last-Modified header.

The combination of these two things triggers most browsers to cache the result for a while, requiring consumers of these endpoints to use "cache-busting" techniques like adding timestamps to the query string.

The heuristic used by most browsers to determine how long to cache a result w/ these headers is `(Now - Last-Modified) / 10`. So if I pull `/api/contents` for something that hasn't changed in ten hours, the browser will cache that result for one hour.

More details in https://github.com/nteract/nteract/issues/3850

Start by tracing the handlers for `/api/contents` and the other `/api` routes mentioned in the issue. Inspect their response headers and any related tests; done means the affected responses provide explicit cache behavior so clients no longer need timestamp-based cache busting.

Written by the indexing model from the issue text.