I'm in #buildout working on this. We might have sorted out what's going on. It appears we still aren't geting the Vary header sent if Accept-Encoding: gzip is sent. Only if Accept-Encoding: identity is sent. Trying to find my ssh key (ugh laptop I don't normally use) so I can get that header sent on every reply.