Turns out this gets handled by our cdn in prod - so didnt spend more time on it, but it seems usikg conditional headers to get etaga causes Vary to always present only 'Origin' so locally pur iOS clients would complain the original response and cached responses have different Vary headers, which makes all caches busted because they are strict on headers.