Cookies must be set on the Response instead of the Request