I've had a similar problem (see Safari Caching GET request even with disabled cache). Adding Vary: * forced Safari to stop caching. Nothing else worked, including Vary: Cookie even though cookies changed between requests.
This answer helped me:
https://stackoverflow.com/a/2068353/1364158