Why do we use a “Vary” header for CSRF and CORS? Won’t it lead to saving too many copies of the same page?
