G'Day!
The difference behavior between the add_header and ngx_lua's variable API is caused by Nginx's script engine.
add_header treats the second paramter as a "complex value", and will be parsed by Nginx's script engine, this engine
indexed any variables in this "complex value", it processes the "complex value" for twice, one for length, the other for
the value, so index variables can reduce the overhead. Of course some "no cacheable" variables value will be flushed before
next time this "complex value" is interpreted.
While ngx_lua just call ngx_http_get_variable, which just fetch them, but never check their flags, like NGX_HTTP_VAR_NOCACHEABLE
or others, maybe we can post an issue to the repository?