Setting cookies when sending the response happens too late in the shutdown hook.

It might be worth looking into using Response::sendContent() over Response::send() and then manually filtering/handling appropriate headers in the send_headers hook instead.

Ideally we'd filter out headers such as Cache-Control which causes unexpected behavior as seen in #456.

EDIT: I went ahead and implemented the above.