Vary:Cookie validation doesn't work in private browsing