Whoops - was looking for set-cookies in the request, not the response