allow setting cookie header