As mentioned in #914 ...

Section 12.5.5

An origin server SHOULD send a Vary header field when its algorithm
for selecting a representation varies based on aspects of the request
message other than the method and target URI, unless the variance
cannot be crossed or the origin server has been deliberately
configured to prevent cache transparency. [...]

I don't think I know what it means to "cross" a variance. The example (elided from this comment) about Authorization not needing to be included gives some hint as to what is meant, but I still don't have a clear picture.