anchor.diff:      error 751 "http://<%= site %>" + req.url;
     }
     <% end%>
  +  if(req.http.Cookie) {
  +    cookie.parse(req.http.Cookie);
  +  }
     <% unless rack_env?(:production) %>
  +  # Filter https_ok cookie from incoming request
  +  if (cookie.isset("https_ok") {
  +    cookie.delete("https_ok");
  +    set req.http.X-Https-Ok = "1";
  +  }
  +
     # Redirect http to https if 'https_ok' cookie is set
  -  if(req.http.X-Forwarded-Proto !~ "(?i)https" && req.http.Cookie) {
  -    cookie.parse(req.http.Cookie);
  -    if(cookie.get("https_ok") == "1") {
  -      error 751 "https://" + req.http.host + req.url;
  -    }
  +  if(req.http.X-Forwarded-Proto !~ "(?i)https" && req.http.X-Https-Ok == "1") {
  +    error 751 "https://" + req.http.host + req.url;
     }
     <% end %>
   
  
positive.code: 
  # Set a header to track a cache HIT/MISS.
  sub vcl_deliver {
    if (req.http.X-Forwarded-Proto ~ "(?i)https") {
      set resp.http.Strict-Transport-Security = "max-age=3600";
      cookie.parse(req.http.Cookie);
      if(cookie.get("https_ok") != "1") {
        header.append(resp.http.Set-Cookie,"https_ok=1");
      }
    }
  
    if (obj.hits > 0) {
      set resp.http.X-Varnish-Cache = "HIT";
  
negative.code:   # Varnish cache temporarily. The session cookie allows all authenticated users
    # to pass through as long as they're logged in.
    if (req.http.Cookie) {
      if (req.url ~ "^/volunteers") {
        cookie.filter_except("_fe_session,hour_of_code,NO_CACHE");
      } else if (req.url ~ "^/auth") {
  