disable set-cookie headers from backend