Without X-Vary-On, we don't have a generic mechanism for web developers to specify how cookies should affect caching behavior. This is actually OK, because the introduction of new cookies ought to be extremely rare. Cookies can wreak havoc on cache hit rates; they're bad for performance; and they raise complicated legal and moral questions. I therefore propose making it a requirement for developers that wish to introduce cookies to seek permission by e-mailing this list. If there aren't any objections, I'll add this requirement to the deployment guidelines.