setting cookies headers is now allowed