mozilla/affiliates — pull request #219 by Osmose (2014-05-22 16:29:42+00:00)
Title: Bug 1014273: Do not cache for anonymous users getting cookies.

Our load balancer is currently caching responses that send no cookies,
which causes a problem when that response sends a CSRF cookie. Since it
caches the response, all users get the same CSRF cookie, which causes
403 issues when the user attempts to POST during login.

The solution is to not cache responses under the specific circumstance
where a user is anonymous, sent no cookies, and received cookies. This
way, if a user comes in with cookies already set, we can still benefit
from caching for them without an issue since we vary on cookies. But
users who need their cookies set with the CSRF token for the first time
can get an un-cached response.