Current implementation has issue with cookies.
When you invoke
Actually only one Set-Cookie header is sent with comma-separated cookies.
But no browsers understand such syntax (it's against RFC6265).
And actually only first cookie is set.
For more details and code examples see