anchor.diff:  
   # Set a header to track a cache HIT/MISS.
   sub vcl_deliver {
  +  <% unless rack_env?(:production) %>
     if (req.http.X-Forwarded-Proto ~ "(?i)https") {
       set resp.http.Strict-Transport-Security = "max-age=3600";
  -    cookie.parse(req.http.Cookie);
  -    if(cookie.get("https_ok") != "1") {
  -      header.append(resp.http.Set-Cookie,"https_ok=1");
  -    }
  -  }
  +    if(req.http.X-Https-Ok != "1") {
  +      header.append(resp.http.Set-Cookie,"https_ok=1; Path=/; Expires=" + cookie.format_rfc1123(now, 5h) + "; HttpOnly");
  +    }
  +  }
  +  <% end %>
   
     if (obj.hits > 0) {
       set resp.http.X-Varnish-Cache = "HIT";
  
positive.code:     error 751 "http://<%= site %>" + req.url;
    }
    <% end%>
    <% unless rack_env?(:production) %>
    # Redirect http to https if 'https_ok' cookie is set
    if(req.http.X-Forwarded-Proto !~ "(?i)https" && req.http.Cookie) {
      cookie.parse(req.http.Cookie);
      if(cookie.get("https_ok") == "1") {
        error 751 "https://" + req.http.host + req.url;
      }
    }
    <% end %>
  
  
negative.code:   # Varnish cache temporarily. The session cookie allows all authenticated users
    # to pass through as long as they're logged in.
    if (req.http.Cookie) {
      if (req.url ~ "^/volunteers") {
        cookie.filter_except("_fe_session,hour_of_code,NO_CACHE");
      } else if (req.url ~ "^/auth") {
  