Add vary cookie for accessed session as per flask

src/flask_session/base.py

@@ -262,6 +262,12 @@ def save_session(
         # Generate a prefixed session id
         store_id = self._get_store_id(session.sid)
 
+        # Add a "Vary: Cookie" header if the session was accessed at all.
+        # This assumes the app is checking the session values in a request that
+        # behaves differently based on those values. ie. session.get("is_authenticated")
+        if session.accessed:
+            response.vary.add("Cookie")
+
         # If the session is empty, do not save it to the database or set a cookie
         if not session:
             # If the session was deleted (empty and modified), delete the saved session  from the database and tell the client to delete the cookie