Make sure to set cookie before returning response