Fix for 19649

This is a basic implementation that records access to cookies, and a CommonMiddleware change that sets the Vary: Cookie header automatically.