commented on the [other thread](https://github.com/FriendsOfSymfony/FOSHttpCache/issues/70) - i think in the end we need 2 things:

* for the 1st request we need configuration know on what to vary. default should be Cookie, Authenticate
* for the 2nd request, we need to know how the hash header is called so that we vary on that. if i understand correctly, we get this request including the cookie/authenticate and have just normal symfony processes resolving that user and then execute in his context but the response vary only on the group, so the next user in the same group gets the same content. if a page is individual, its that pages responsibility to have additional vary headers.