Only set vary header if the filter check is passed

pulled, fixed, and rebased from #849 
closes #848

note: i'd rather be liberal with the use of `vary`, but i don't think this will break anything since most CDNs only support `Accept-Encoding` in `Vary` headers.