fix set header (cookie), fix race condition