robust hashing of header list for caches

[Geal]

follow-up on #285 (comment)

the query deduplication PR #285 hashes all the headers in the order they are provided, which could result in duplication if multiple similar queries come with headers in a different order. As @garypen said, we could define an order for hashing the headers, which would allow deduplicating more queries

[Geal]

while we are here, we should make the deduplication configurable. ie hashing on some headers but not other ones, depend on the authorization status, etc