Make sure to set cookie before returning response

Ran into an issue with a security review; our CSRF tokens weren't getting rotated, even after we upgraded to 1.5.4.

It seemed that it was getting set in the request.META, but not actually making it to the response headers.

This logic fixes the problem for us -- it's undoubtedly flawed. Let me know if this makes sense.