add note about set-cookie