When an http response has two Set-Cookie in the header, response['Set-Cookie'] will return a single string. This string will be the two returned cookies separated by a comma, concatenated together. Instead this should use get_fields('Set-Cookie') which returns an array of returned cookie strings.