Add Authorization to Vary header

ping @Ocramius @mac_nibblet

When you use OAuth2 for your authorization, you likely hit your API with URLs like api.mywebsite.com/users/2, with a value inside the Authorization header.

However, this can be a problem for proxy server or for cacheable content in browser, because you likely need to perform authorization, and api.mywebist.com/users/2 may not return the same result for user A and B. To that extent, we need to add the Authorization value to the Vary header, to indicate proxy servers to use it to differentiate two resources.

This PR simply attaches a listener at the end of the request.