Set cookie once we know we have HTML

This should resolve
https://github.com/chiselwright/plack-middleware-xsrfblock/issues/12