Expires Headers / Cache Validator / Use cookie

Bonjours à toutes et à tous.

Alors voilà, PageSpeed et Yslow me retourne les recommandations suivantes :

Specify a cache validator
Add Expires headers
Use cookie-free domains

Voici mon htaccess :

Header unset Cache-Control
</FilesMatch>
</IfModule>
# END Cache-Control Headers
#Options +FollowSymlinks
RewriteEngine on
ReWriteCond %{HTTP:accept-encoding} gzip
RewriteCond %{HTTP_USER_AGENT} !Safari
ReWriteCond %{REQUEST_FILENAME} !^.+\.gz$
RewriteCond %{REQUEST_FILENAME}.gz -f
RewriteRule ^(.+) $1.gz [QSA,L]
<IfModule mod_gzip.c>
mod_gzip_on Yes
mod_gzip_dechunk Yes
mod_gzip_keep_workfiles No
mod_gzip_can_negotiate Yes
mod_gzip_add_header_count Yes
mod_gzip_send_vary Yes
mod_gzip_command_version '/mod_gzip_status'
mod_gzip_min_http 1000
mod_gzip_minimum_file_size 300
mod_gzip_maximum_file_size 512000
mod_gzip_maximum_inmem_size 60000
mod_gzip_handle_methods GET POST
mod_gzip_temp_dir /tmp
mod_gzip_item_include file \.html$
mod_gzip_item_include file \.php$
mod_gzip_item_include file \.pl$
mod_gzip_item_include file \.rb$
mod_gzip_item_include file \.py$
mod_gzip_item_include file \.cgi$
mod_gzip_item_include file \.css$
mod_gzip_item_include file \.js$
mod_gzip_item_include file \.ttf$
mod_gzip_item_include mime ^application/javascript$
mod_gzip_item_include mime ^application/x-javascript$
mod_gzip_item_include mime ^text/.*
mod_gzip_item_include mime ^httpd/unix-directory$
mod_gzip_item_include handler ^cgi-script$
mod_gzip_item_include handler ^server-status$
mod_gzip_item_include handler ^server-info$
mod_gzip_item_include handler ^application/x-httpd-php
mod_gzip_item_exclude mime ^image/.*
</IfModule>
# KILL THEM ETAGS
Header unset ETag
FileETag MTime Size 
FileETag none
# protection de la lecture des répertoires
Options -Indexes
# protect the htaccess file
<files .htaccess>
order allow,deny
deny from all
</files>

et le début de mon code php :

<?php
session_start();
ob_start('ob_gzhandler');
header('Content-Type: text/html; charset=utf-8');
$cookie_domain = 'www.mon_url.fr';

Une idée de ce qui cloche ?