cache-control cannot be applied here, as we need a way to programmatically invalidate on some CRUD operations (e.g. display a list of users while invalidate the cache when adding new ones to the database, with routes like /users/students, /users/students/new).