fixed deadlocks by setting cookie directly on headers instead of creating a response