Added a test to verify headers set by default middleware; refs #23939.

Why is `Vary: Cookie` in this list? Doesn't that contradict the stated goal of the test? (I realize that it won't pass without that, until #3672 is merged).