Only remove Set-Cookie from public responses.