function do_global_read_request()
-    local cookie = ts.client_request.header['Cookie']
-
-    if cookie then
-        -- Equivalent to req.http.Cookie ~ "([sS]ession|Token)=" in VCL
-        if string.match(cookie, '[sS]ession=') or string.find(cookie, 'Token=') then
-            return pass()
-        end
-    end
-
     if ts.client_request.header['Authorization'] then
         return pass()
     end
 end
 
+function do_global_cache_lookup_complete
+    local cache_status = ts.http.get_cache_lookup_status()
+    if cache_status == TS_LUA_CACHE_LOOKUP_HIT_FRESH then -- XXX what about HIT_STALE?
+       local vary = ts.cached_response.header['Vary']:lower()
+       if vary and string.match(vary, 'cookie') then
+            local cookie = ts.client_request.header['Cookie']
+            if cookie and ( string.match(cookie, '[sS]ession=') or string.find(cookie, 'Token=') ) then
+               -- XXX don't use the object we just found
+            end
+        end
+    end
+end
+