Sets cookies via http header rather than servlet cookie support.

This works around the fact that httpOnly is not respected in the servlet cookie stuff.