If I don't set USERNAME and PASSWORD, res.headers['set-cookie'] is nil and I get:

<pre>
[-] Exploit failed: NoMethodError undefined method `split' for nil:NilClass
</pre>

I guess you should check for the presence of res.headers['set-cookie'] before