<p>I'm writing a resource handling method where I control access to various files, and I'd like to be able to make use of the browser's cache.  My question is two-fold:</p>

<ol>
<li><p>Which are the definitive HTTP headers that I need to check in order to know for sure whether I should send a 304 response, and what am I looking for when I do check them?</p></li>
<li><p>Additionally, are there any headers that I need to send when I initially send the file (like 'Last-Modified') as a 200 response?</p></li>
</ol>

<p>Some psuedo-code would probably be the most useful answer.</p>

<hr>

<p>What about the cache-control header?  Can the various possible values of that affect what you send to the client (namely max-age) or should only if-modified-since be obeyed?</p>

You should send a 304 if the client has explicitly stated that it may already have the page in its cache. This is called a conditional GET, which should include the
if-modified-since
header in the request.
Basically, this request header contains a date from which the client claims to have a cached copy. You should check if content has changed after this date and send a 304 if it hasn't.
See
http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.25
for the related section in the RFC.