CXRF issues w/phpMyAdmin, Adminer, etc

[nodeki]

It seems the tokens generated by phpMyAdmin, Adminer, and other database management tools (SQLBuddy) aren't properly handled with the VCL as it is right now. Since they're being generated on-demand (IIRC), the tokens aren't being updated and when you attempt to log-in, it prevents authorization and you're brought back to the log-in page; effectively preventing you from accessing / using a database management tool inside or outside of WordPress.

I tried modifying the VCL to allow them to pass, though I'm still tinkering with Varnish. Perhaps you know of a way around this? If you install Adminer (by itself, single PHP file), you should be able to replicate this easily. The same applies for Adminer as a WordPress plugin, SQLBuddy, and phpMyAdmin. I've not yet tested others.