When an http response has two Set-Cookie in the header, response['Set-Cookie'] will return a single string. This string will be the two returned cookies separated by a comma, concatenated together. Instead this should use get_fields('Set-Cookie') which returns an array of returned cookie strings.
The syntax of cookies is described in http://www.ietf.org/rfc/rfc2109.txt, section 4.1. Cookies are attribute-value pairs, so split should only return 2 values. This will allow '=' within the value of a cookie.