anchor.diff:    if(req.http.X-Forwarded-Proto !~ "(?i)https" && req.http.X-Https-Ok == "1") {
       error 751 "https://" + req.http.host + req.url;
     }
  -  <% end %>
   
     C{
         vcl_rewrite_accept_language(sp);
  
positive.code:   if(req.http.Cookie) {
      cookie.parse(req.http.Cookie);
    }
    <% unless rack_env?(:production) %>
    # Filter https_ok cookie from incoming request
    if (cookie.isset("https_ok")) {
      cookie.delete("https_ok");
  
negative.code:   set beresp.grace = 1h;
  }
  
  sub vcl_deliver {
    # Add HTTP Strict Transport Security header and https_ok cookie to response
    if (req.http.X-Forwarded-Proto ~ "(?i)https") {
      set resp.http.Strict-Transport-Security = "max-age=3600";
      if(req.http.X-Https-Ok != "1") {
        header.append(resp.http.Set-Cookie,"https_ok=1; Path=/; Expires=" + cookie.format_rfc1123(now, 5h) + "; HttpOnly");
      }
    }
  
    # Set a header to track a cache HIT/MISS.
    if (obj.hits > 0) {
      set resp.http.X-Varnish-Cache = "HIT";
    }
  