using Varnish header to control access