added new VCL rules by default. allow Authorisation headers by default, this was being passed by default