According to the documentation in default.settings.php, and I've seen similar descriptions elsewhere, "Without "Vary:Cookie", authenticated users would also be served the anonymous page from the cache."
However $conf['omit_vary_cookie'] = TRUE;
is recommended with Varnish in Drupal 7 and doesn't seem to keep users from being able to switch from anon to authenticated sessions. Is this a header that Varnish doesn't actually care about?