Isn't that the same thing? Say that you forget to specify that "my_login_cookie" should vary the response from the backend. User A logs in. Now user B logs in,

Isn't that the same thing? Say that you forget to specify that "my_login_cookie" should vary the response from the backend. User A logs in. Now user B logs in, but because the page was cached from user As visit, user B sees the content for user A. B is not "logged in" as A, but can still see their content.