add Set-cookie to header