In Varnish3, all outbound requests ultimately ran through vcl_deliver on their way out. With Varnish4, several classes of response do not pass through vcl_deliver and instead use vcl_synth as an alternative code path. Those classes include:

• synthetic response from vcl_recv and/or vcl_hash
• backend fetch failures
• PURGE

We have a lot of code hooked into vcl_deliver, and much of it (but probably not all) should also be invoked for the vcl_synth path for non-PURGE requests, for things like X-Cache, X-Analytics, HSTS-setting, etc. It's a little bit complicated to untangle this, but we need to.