Don't use pass for all requests with a session cookie

Pass prevents any and all caching, even if the Cookie header is not
varied on.

Change-Id: I445f1fad58a3143cdc9533b0f3473cc986969589