looks like varnish isn't ready for cache-control: private
account_controller methods should all be private to proxies