Can you check if it already has `Authorization` in Vary header? Just to avoid duplication.