That's the varnish default behaviour, excerpt from the default config [1]:
sub vcl_recv {
#...
if (req.http.Authorization || req.http.Cookie) {
/* Not cacheable by default */
return (pass);
}
#...
}
[1] https://www.varnish-cache.org/docs/3.0/reference/vcl.html#examples