Wikimedia Bugzilla is closed!

        /* FIXME: deploy X-Vary-Options support */
        set req.http.X-Orig-Cookie = req.http.Cookie;
-       if(req.http.Cookie ~ "disable" || req.http.Cookie ~ "optin" || req.http.Cookie ~ "session") {
+       if(req.http.Cookie ~ "disable" || req.http.Cookie ~ "optin") {
                /* Do nothing; these are the cookies we pass.
                 * this is a hack in the absence of X-V-O support
                 */

This is fixed now with: https://gerrit.wikimedia.org/r/12206

We need to find a better way to do this without proper X-V-O support in Varnish.