Bypass Varnish cache if user is logged in
So the answer is to test the cookie for a name with username in it, and pass if it exists. You could also check for an exactly 32 digit alphanumeric cookie name I guess.

if (
 req.http.Cookie ~ "username" # Craft sessions have the word username in them
)
{
    return (pass);
}`