You seem very confident there's always gonna be a cookie?  I would just recommend:

(res.headers['Set-Cookie'] || '').split(',')