302 redirect with Set-Cookie