I run a D7 site that for some reason is not allowing users to reset their passwords, but only on the server. The email with the one-time login link is sent just fine, but when the user clicks on the link, they get a 403 page with the generic "You are not authorized to access this page" message. I know this must be server environment specific, because with a clone of the site on my local machine (sending the email using the SMTP module), it works just fine. I'm guessing the issue happens in user_edit_access(), where it is comparing the value of $account->uid with $GLOBALS['user']->uid, but that's just a guess at this point.
Any suggestions as to what the problem could be? The servers are using Varnish, so that's one thought that came to mind, but I'm not sure how to figure that out.