Revert "remove the list from response.vary. not sure why I was getting an error using openid without it, but everything seems to be working fine now"

This reverts commit 05ceada051dad011bb9b3e1c93fb42b2d9875939.

It turns out the reason for this in the first place was werkzeug
backwards compatibility.

mediagoblin/meddleware/csrf.py

@@ -111,7 +111,7 @@ class CsrfMeddleware(BaseMeddleware):
             httponly=True)
 
         # update the Vary header
-        response.vary = (getattr(response, 'vary', None) or []) + ['Cookie']
+        response.vary = list(getattr(response, 'vary', None) or []) + ['Cookie']
 
     def _make_token(self, request):
         """Generate a new token to use for CSRF protection."""