ok, i see. so we would *not* vary on the Cookie, but read the sessionid from the cookie header as normal. i see your point, but still think there are drawbacks:

* need to adjust the backend as well, or things wont cache anymore
* if i start to look at other cookies in the backend, i maybe won't notice that i start mixing up the hash between different groups. if the cookie only contains what is relevant, i will notice there is a problem when expecting more cookies and be forced to think what i am doing.