and use res.get_cookies here since it's more reliable
https://github.com/rapid7/metasploit-framework/blob/437bc821c071a9d155c13c5797a7dc4e5741e3bd/lib/rex/proto/http/response.rb#L65