Add Vary: Cookie header to the response if cookie is set

[simonw]

Follow up from #7. This should ensure the middleware works correctly in conjunction with caching such as Cloudflare.

Also refs simonw/datasette#798

[simonw]

Here's how Django does it:

https://github.com/django/django/blob/f283ffaa84ef0a558eb466b8fc3fae7e6fbb547c/django/middleware/csrf.py#L185-L197

            # Set the Vary header since content varies with the CSRF cookie.
            patch_vary_headers(response, ('Cookie',))

https://github.com/django/django/blob/f283ffaa84ef0a558eb466b8fc3fae7e6fbb547c/django/utils/cache.py#L276-L298

cc_delim_re = _lazy_re_compile(r'\s*,\s*')
# ...
def patch_vary_headers(response, newheaders):
    """
    Add (or update) the "Vary" header in the given HttpResponse object.
    newheaders is a list of header names that should be in "Vary". If headers
    contains an asterisk, then "Vary" header will consist of a single asterisk
    '*'. Otherwise, existing headers in "Vary" aren't removed.
    """
    # Note that we need to keep the original order intact, because cache
    # implementations may rely on the order of the Vary contents in, say,
    # computing an MD5 hash.
    if response.has_header('Vary'):
        vary_headers = cc_delim_re.split(response['Vary'])
    else:
        vary_headers = []
    # Use .lower() here so we treat headers as case-insensitive.
    existing_headers = {header.lower() for header in vary_headers}
    additional_headers = [newheader for newheader in newheaders
                          if newheader.lower() not in existing_headers]
    vary_headers += additional_headers
    if '*' in vary_headers:
        response['Vary'] = '*'
    else:
        response['Vary'] = ', '.join(vary_headers)