Fix vcl indenting
Prevent PURGE requests when X-Real-IP is present

All requests coming into Varnish have a client.ip of localhost as they
come from Nginx on the same machine. This change checks for the
X-Real-IP header that is set by Nginx and prevents PURGE requests if it
is present.

This is really nasty. Unfortunately Varnish doesn't let you check
arbitrary headers against an acl.
Allow PURGE requests on www domain

We have logic that switches between the backdrop read and write APIs
based on the verb. This catches PURGE requests and allows them to be
passed on to get handled by the PURGE section below.
Move PURGE http verb filtering into nginx

Rather than preventing external PURGE requests in Varnish handle it in
the externally facing Nginx vhost.

Checking that a request came through Nginx by checking for the presence
of a header that it sets is horribly opaque.
Upgrade puppet-nginx to allow verb filtering

Upgrade puppet-nginx to allow filtering by HTTP verb. This is used by
the stagecraft vhost to prevent PURGE requests from outside.
Merge pull request #296 from alphagov/allow-purge-on-www

Improve PURGE request handling in Varnish