Update tests to NOT rely on the set-cookie res header (for security)