Varnish Cookies with Authcache
Copy pasta of Znerol's excellent answer to the incorrect bug I raised:


  The VCL shipping with Authcache Varnish needs to be adapted for
  Authcache Debug. The widget uses a cookie (aucdbg) with a unique value
  for each request in order to distinguish between cache hits and
  misses.
  
  By default the standard cache policy kicks in for anonymous users.
  I.e. requests having a cookie will be passed to the backend by
  Varnish. When you use ab for testing, no cookies will be sent along
  with the request and therefore the cache actually kicks in. When
  testing with the browser, the aucdbg and js cookies are added by
  JavaScripts and therefore the requests are bypassing the cache.
  
  Look for Example 4: Trigger key-retrieval for all users, including
  anonymous. in vcl_recv and enforce key-retrieval for all users. When
  this fragment is enabled, requests for anonymous users will be handled
  exactly like those for authenticated users and the default varnish
  cache policy will be disabled.


Un-commenting section 4 in the Authcache default.vcl solved this problem.