should we not say: "By default, Varnish does not cache responses when a Cookie or Authorization header is present in the request. Here we force it to cache the user hash resolution if the backend thinks its possible." and then have `return (lookup);` not commented out.