the server can send 0 or more set-cookie headers