eliminates "Vary QS to fill up cache" trivial DDOS