Document limitations of cache middleware more clearly

[Carl Meyer]

Our documentation for the ​full-page-caching middleware does not discuss Vary: Cookie at all, which is a major omission. For most typical dynamic Django sites, every single page served will rely on a user-specific cookie of some kind (whether that be a session cookie, a CSRF cookie, a messages cookie, or a tracking cookie (Google Analytics et al)). This means that (unless there is another bug) the response should include Vary: Cookie, turning the full-page cache into a per-user cache, dramatically ballooning its size-to-hits ratio, which is almost certainly not what the developer expected or intended.

In my opinion this means that the cache middleware is simply not suitable for use on most Django sites, which raises the question of whether it belongs in Django at all. But at the very least this issue should be clearly discussed in the documentation.

I can put together a pull request for this soon, just filing the ticket so as not to lose track of it.