Ig this doesn't happen with port forward since it uses localhost which is expected to be insecure and so the cookie can be set regardless of the Set-Cookie setting