The browser `Response` constructor removes `set-cookie` headers and so we set them manually. closes #1470