Avoid caching pages for authenticated users with Varnish
In your settings.php are you using $conf['omit_vary_cookie'] = TRUE; ?

If so, logged in users who have previous viewed a page when logged out will be served the varnish cached version of their page until they manually refresh their browser.

The solution is to simply comment out $conf['omit_vary_cookie'] = TRUE; in your settings.php.

This is explained in default.settings.php (drupal 7.34):

 /**
 * Page caching:
 *
 * By default, Drupal sends a "Vary: Cookie" HTTP header for anonymous page
 * views. This tells a HTTP proxy that it may return a page from its local
 * cache without contacting the web server, if the user sends the same Cookie
 * header as the user who originally requested the cached page. Without "Vary:
 * Cookie", authenticated users would also be served the anonymous page from
 * the cache. If the site has mostly anonymous users except a few known
 * editors/administrators, the Vary header can be omitted. This allows for
 * better caching in HTTP proxies (including reverse proxies), i.e. even if
 * clients send different cookies, they still get content served from the cache.
 * However, authenticated users should access the site directly (i.e. not use an
 * HTTP proxy, and bypass the reverse proxy if one is used) in order to avoid
 * getting cached pages from the proxy.
 */
# $conf['omit_vary_cookie'] = TRUE;


This DA question answers this issue too: What does the &quot;Vary: Cookie&quot; header actually do for serving pages from Varnish?