This check is same as the Security component does to init a Firewall, so i guess it's not so expensive. But as @lolautruche say we can only check the http verb and a magic header set in varnish.