Always vary based on Authorization header

Always vary based on Authorization header

See https://gitlab.com/gitlab-org/gitter/webapp/-/merge_requests/2019#note_424095474

When the first anonymous request comes through, we cache it based on the vary headers which does not include Authorization Then when the second authenticated request comes through, we don't take into account Authorization because it wasn't listed to vary before. This causes us to serve the anonymous response for the authenticated user.

In this specific case, it matters because the response doesn't include the permissions field we want but could have many consequences throughout the codebase.

1. https://api.github.com/repos/gitter-integration-tests/public-repo-1 with Authorization: Basic xxx (anonymous request using the public token pool client_id and client_secret)
   • No permissions in response
   • -> vary: Accept, Accept-Encoding, Accept, X-Requested-With (notice that Authorization is not in this list)
2. https://api.github.com/repos/gitter-integration-tests/public-repo-1 with Authorization: token xxx
   • permissions in response
   • -> vary: Accept, Authorization, Cookie, X-GitHub-OTP, Accept-Encoding, Accept, X-Requested-With

Todo

• Add tests