My only other concern with vardiff is that when you enabled it on the main pool, it was done per worker.
Does vardiff now work by used the x-mining-hashrate header if available?
It uses x-mining-hashrate only for the initial difficulty. After it has measured the worker's hashrate it uses that as a basis for difficulty. Using only x-mining-hashrate basically means letting the user select the difficulty - I'm not sure that's a good idea.
I have a pool-wide setting for max difficulty though. I can set this to what is appropriate for 1 minirig now, and later adjust up to what is appropriate for 1 SC minirig. So 10 minirigs running on the same worker account will get the same difficulty as 1 minirig.
Is that then still an issue?
GBT replaced X-Mining-Hashrate with the "target" request option (BIP 23 Basic Pool Extensions). Stratum has no equivalent (and no HTTP for headers) yet.
I didn't implement the target request option yet. I don't know if I would use it for anything but the first minute either. Letting a user with 10+ TH/s set the difficulty makes me a bit uneasy.