varnish: Strip cookies with _ prefix, not just __

Rationale is that these should be for client-side or third-party use,
and need not be visible to the backend.