is it good enough to unconditionally do this, or should we add a request matcher or rule matcher again to allow to only vary some responses (e.g. keep a public area that does not depend on login...)