Interesting as I'm not too familiar with Varnish. However it seems to me like it would be easier in many cases to pull out the session ID and then have a simple script which uses that to set the X-Auth-User header since most sites using authentication do so with session cookies.