Revert "remove the list from response.vary. not sure why I was getting an error using openid without it, but everything seems to be working fine now"

This reverts commit 05ceada051.

It turns out the reason for this in the first place was werkzeug
backwards compatibility.

mediagoblin/meddleware/csrf.py

@@ -111,7 +111,7 @@ class CsrfMeddleware(BaseMeddleware):
             httponly=True)
 
         # update the Vary header
-        response.vary = (getattr(response, 'vary', None) or []) + ['Cookie']
+        response.vary = list(getattr(response, 'vary', None) or []) + ['Cookie']
 
     def _make_token(self, request):
         """Generate a new token to use for CSRF protection."""