the server might send more than one Set-Cookie header