assets/js-vars/user.js should set Cache-Control header to prevent caching by proxies

Describe the bug The services: assets/js-vars/user.js and assets/js-vars/global.js don't set the Cache-Control header resulting in incorrect caching.

Depending on who accesses the site and when, the button on search for speakers is disabled as the reverse proxy caches the version of user.js for unauthenticated users. In CloudFlare's case the file is cached for 4 hours at a time.

This is easiest to see up on Cloudflare, but might also happen with other reverse proxies (Varnish, Squid, Fastly, Apache Proxy).

Cloudflare's default caching rules are to cache GETs to paths that end in .js for 4 hours, unless the Cache-Control or max-age header is set ... see: Cloudflare Default cache behaviour

To Reproduce Steps to reproduce the behavior:

1. Setup out of box Indico site
2. Put site behind Cloudflare in reverse proxy mode with default caching rules on
3. Setup a conference and add a contribution (without a speaker)
4. Edit the contribution and search for a speaker/author from the edit contribution button, but the button is disabled (greyed out)
5. Use web "Inspect" to check network and see that the Cloudflare headers have been added and max-age=14400

Expected behavior The button should be active if the person has access, and user.js and global.js should not be cached by any proxy/reverse proxy.

The cache-control header should be set to private: (i.e. Cache-Control: private), for those two files as that would allow caching at the browser level of the response.

Additional context

This issue has been reported a number of times on the forums:

• https://talk.getindico.io/t/add-from-search-randomly-grays-out/3583
• https://talk.getindico.io/t/search-greyed-out-for-adding-speakers/2850

CloudFlare info:

• https://developers.cloudflare.com/cache/concepts/default-cache-behavior/