After implementing this solution i agree with dbu the good practice is wrong as this can have some bad effects: 

Like, i'm a anonymous user, i logged in but my session id is the same, in this case we need to invalidate the hash (best way is to change the session id) or we will have page like we were never logged in :/

IMO, we should say that caching the HEAD request is possible but need extra work to invalidate the hash on right / authentication changes.