Add vary cookie header

See github.com/justinas/nosurf/issues/3