We have a ton of records.config options around Vary. One particularly worrisome header for alternates is the User-Agent header -- there are so many of them. Most CDNs don't allow this -- but, we don't have any obvious ways to stop it (eg, minimally hard in header_rewrite; don't know of another).