anchor.diff:    # Varnish cache temporarily. The session cookie allows all authenticated users
     # to pass through as long as they're logged in.
     if (req.http.Cookie) {
  -    cookie.parse(req.http.Cookie);
       if (req.url ~ "^/volunteers") {
         cookie.filter_except("_fe_session,hour_of_code,NO_CACHE");
       } else if (req.url ~ "^/auth") {
  
positive.code:     error 751 "http://<%= site %>" + req.url;
    }
    <% end%>
    <% unless rack_env?(:production) %>
    # Redirect http to https if 'https_ok' cookie is set
    if(req.http.X-Forwarded-Proto !~ "(?i)https" && req.http.Cookie) {
      cookie.parse(req.http.Cookie);
      if(cookie.get("https_ok") == "1") {
        error 751 "https://" + req.http.host + req.url;
      }
    }
    <% end %>
  
  
negative.code: 
  # Set a header to track a cache HIT/MISS.
  sub vcl_deliver {
    <% unless rack_env?(:production) %>
    if (req.http.X-Forwarded-Proto ~ "(?i)https") {
      set resp.http.Strict-Transport-Security = "max-age=3600";
      if(req.http.X-Https-Ok != "1") {
        header.append(resp.http.Set-Cookie,"https_ok=1; Path=/; Expires=" + cookie.format_rfc1123(now, 5h) + "; HttpOnly");
      }
    }
    <% end %>
  
    if (obj.hits > 0) {
      set resp.http.X-Varnish-Cache = "HIT";
  