Pylons/pyramid — pull request #1348 by mmerickel (2014-05-18 05:11:56+00:00)
Title: force default sessions and authtkt to set the vary header for cookies

replaces #1342 and adds support for authtkt headers

related https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued/