Varnish 3.0 and Drupal 7, get registered user to always have non-cached content

Question

I have issue with Varnish on Drupal 7 detailed here: http://drupal.org/node/1886218

Basically, what happens is:

1. User visits the certain page as anonymous, gets content served by Varnish Cache (OK)
2. Logs in
3. Clicks the link of the page that he visitied as anonymous previosly, but he gets cached page, instead of user-specific (that should not happen)
4. If he reloads page (f5), he gets backend served page, but if he clicks that link on the menu, he gets cached page.

It turns out that cached page was delivered by browser, not by Varnish; anyway, that should not happen, because user thinks he is logged out (I have user specific block in header).

How i can deliver such cache-control in header, so Registered users always get updated (not cached) content, even if they browsed site as anonymous before they have logged in ?

Thanks for help!

HTTP response:

The url we checked: www.mydomain.com
    HTTP/1.1 200 OK
Server: Apache (removed from security)
X-Powered-By:   PHP(removed from security)
X-Drupal-Cache: MISS
Expires:    Sun, 19 Nov 1978 05:00:00 GMT
Last-Modified:  Tue, 15 Jan 2013 08:38:54 +0000
Cache-Control:  public, max-age=10800
ETag:   "1358239134-1"
Content-Language:   hr
X-Generator:    Drupal 7 (http://drupal.org)
Link:   <http://www.mydomain.com/>; rel="canonical",<http://www.mydomain.com/>; rel="shortlink"
Vary:   Accept-Encoding
Content-Encoding:   gzip
Content-Type:   text/html; charset=utf-8
Content-Length: 33254
Accept-Ranges:  bytes
Date:   Tue, 15 Jan 2013 08:49:22 GMT
X-Varnish:  1420616326 1420614128
Age:    622
Via:    1.1 varnish
Connection: keep-alive
X-Varnish-Cache:    HIT

Answer 1

You seem to be missing Vary: Cookie in addition to Vary: Accept-Encoding. You may add it in vcl_deliver using something like this:

if (resp.http.Vary !~ "Cookie") {
    set resp.http.Vary = resp.http.Vary + ", Cookie";
    set resp.http.Vary = regsub(resp.http.Vary, "^,\s*", "");
}

Answer 2

Try changing the response Cache-Control headers:

Cache-Control:no-cache, max-age=0, must-revalidate