Added a test to verify headers set by default middleware; refs #23939.

And, presumably, remove `Vary: Cookie` from this list of expected headers?