Varnish caching

By default Varnish will not cache any requests with a Cookie or an
Authorization header. This change tells Varnish to lookup GET or HEAD
requests if the Authorization header is set.

This obviously raises the risk of sending a cached response to an
unauthorised client. This is mitigated by the backend app sending a Vary
header set to 'Authorized'.