add callback to set cookies for the response object

fixes #9