moved cookie options to response doc