exclude set-cookie from headers