Revalidation of cache based on login cookies for whole site

This fixes the cache problem of #631 differently than pull request #632. This works for the whole site and uses the Vary header instead of setting a must-revalidate.

This should work in most browsers (except IE6). All responses now also include an ETag header since that makes the Vary header solution work for IE7 according to the [IEInternals blog](http://blogs.msdn.com/b/ieinternals/archive/2009/06/17/vary-header-prevents-caching-in-ie.aspx?Redirected=true).

If this gets accepted it should be merged instead of #632.