Add Sec-Fetch-User to Vary recommendations.

Closes w3c#12.

Author: mikewest

index.bs

@@ -266,8 +266,9 @@ seem generally applicable:
 1.  Sites should use Fetch Metadata to make good decisions about when to serve resources, as
     described in [[resource-isolation-policy]]. In order to ensure that decision sticks, servers
     should explain its decision to the browser by sending a <a http-header>`Vary`</a> header
-    containing `Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site`. This ensures that the server has
-    a chance to make different decisions for requests which will be *used* differently.
+    containing `Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site, Sec-Fetch-User`. This ensures that
+    the server has a chance to make different decisions for requests which will be *used*
+    differently.
 
 2.  Subresources should opt-out of MIME type sniffing by sending an
     <a http-header>`X-Content-Type-Options`</a> header with a value of `nosniff`. This increases the
@@ -302,7 +303,7 @@ few times below:
 <pre highlight="http">
 Content-Security-Policy: sandbox
 Cross-Origin-Opener-Policy: same-origin
-Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
+Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site, Sec-Fetch-User
 X-Content-Type-Options: nosniff
 X-Frame-Options: DENY
 </pre>
@@ -358,7 +359,7 @@ in question. A few cases are well worth considering:
 	  <strong>Cross-Origin-Resource-Policy: same-origin</strong>
     Content-Security-Policy: sandbox
     Cross-Origin-Opener-Policy: same-origin
-    Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
+    Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site, Sec-Fetch-User
     X-Content-Type-Options: nosniff
     X-Frame-Options: DENY
     </pre>
@@ -386,7 +387,7 @@ in question. A few cases are well worth considering:
     Cross-Origin-Resource-Policy: same-origin</strong>
     Content-Security-Policy: sandbox
     Cross-Origin-Opener-Policy: same-origin
-    Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
+    Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site, Sec-Fetch-User
     X-Content-Type-Options: nosniff
     X-Frame-Options: DENY
     </pre>
@@ -412,7 +413,7 @@ in question. A few cases are well worth considering:
     <strong>Cross-Origin-Resource-Policy: cross-origin</strong>
     Content-Security-Policy: sandbox
     Cross-Origin-Opener-Policy: same-origin
-    Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
+    Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site, Sec-Fetch-User
     X-Content-Type-Options: nosniff
     X-Frame-Options: DENY
     </pre>
@@ -451,7 +452,7 @@ headers could be appropriate:
 <pre highlight="http">
 Cross-Origin-Opener-Policy: same-origin
 Cross-Origin-Resource-Policy: same-origin
-Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
+Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site, Sec-Fetch-User
 X-Content-Type-Options: nosniff
 X-Frame-Options: SAMEORIGIN
 </pre>
@@ -479,7 +480,7 @@ like the following set of response headers might be appropriate:
 <pre highlight="http">
 Cross-Origin-Opener-Policy: same-origin-allow-popups
 Cross-Origin-Resource-Policy: same-origin
-Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
+Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site, Sec-Fetch-User
 X-Content-Type-Options: nosniff
 X-Frame-Options: SAMEORIGIN
 </pre>
@@ -506,7 +507,7 @@ or fetched cross-origin. Three scenarios are worth considering:
     <pre highlight="http">
     Cross-Origin-Resource-Policy: same-origin
     <strong>Cross-Origin-Opener-Policy: unsafe-none</strong>
-    Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
+    Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site, Sec-Fetch-User
     X-Content-Type-Options: nosniff
     X-Frame-Options: SAMEORIGIN
     </pre>
@@ -521,7 +522,7 @@ or fetched cross-origin. Three scenarios are worth considering:
     <pre highlight="http">
     Cross-Origin-Resource-Policy: same-origin
     Cross-Origin-Opener-Policy: same-origin
-    Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
+    Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site, Sec-Fetch-User
     X-Content-Type-Options: nosniff
     <strong>X-Frame-Options: ALLOWALL</strong>
     </pre>
@@ -549,7 +550,7 @@ or fetched cross-origin. Three scenarios are worth considering:
     <pre class="lang-http">
     Cross-Origin-Resource-Policy: same-origin
     <strong>Cross-Origin-Opener-Policy: unsafe-none</strong>
-    Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
+    Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site, Sec-Fetch-User
     X-Content-Type-Options: nosniff
     <strong>X-Frame-Options: ALLOWALL</strong>
     </pre>