Admin features viewable logged out

Here is some additional information:

This issue occurs on macOSX with Chrome, Safari, and Arc. Interestingly, it does not manifest in Firefox. Firefox behaves as expected. I'm uncertain if this detail helps in identifying the underlying issue.

Adding the following to the default.vcl resolves the issue:

sub vcl_hash {

    # ... (existing code)

    /** If Bin is set - add it to hash data for this page */
    hash_data(req.http.X-Bin);

    return (lookup);
}

# Respond to incoming requests.
sub vcl_recv {

    # ... (existing code)

 # Do not cache if the user is logged in as an admin.
    if (req.http.Cookie ~ "^(|.*; ?)S?SESS([a-z0-9]{32}=[^;]+)(;.*|)$" &&
        req.http.Cookie ~ "^(|.*; ?)ADVBIN=administrator(|;.*|)$") {
        set req.http.X-Bin = "role:administrator";
        set req.hash_always_miss = true; # Ensure a cache miss for admin requests
    }

  return (hash);
}

We have tested this on Arc, Chrome, FireFox, and Safari and it works as expected.

Perhaps we are doing something wrong initially. Would love some feedback!