Fixed #19649 -- Set "Vary: Cookie" on any responses that access cookies

This is a basic implementation that records access to cookies, and a CommonMiddleware change that sets the Vary: Cookie header automatically.