reconstitute in the correct order

Save the cookie in the response, but reconstitute before calling other
middleware