Wait, are you telling me that, until two months ago, Cloudflare would actively remove the security from a site that processed Sec-Fetch-* and correctly set the

Wait, are you telling me that, until two months ago, Cloudflare would actively remove the security from a site that processed Sec-Fetch-* and correctly set the Vary header? Seriously?