ive been thinking about this some more and i think i'll have to delay sending the response out so middleware can actually set headers based on the processing happening in the handler (so stuff like private pages can avoid being cached without needing to load that data in a middleware)
