implemented setting cookie on response