title: Can cookies be set from 4xx responses?
body: <p>I just tried setting (actually, deleting - via max age set to 0) a session cookie, when I detect a specific client error. The HTTP response I am using is from the 4xx category (e.g. 401, 406, etc). </p>
  
  <p>The cookie deletion works fine with this kind of response generated on the server side:</p>
  
  <pre><code>            Response resp = Response.status(Response.Status.OK).header(
                  "Set-Cookie",
                  cookieName+"="+sessionId+"; "+
                  "Version=1; Max-Age=0; Path=" + cookiePath + "; " +
                  "Expires=Thu, 01 Jan 1970 00:00:00 GMT").entity("").build();
  </code></pre>
  
  <p>...but fails with this:</p>
  
  <pre><code>            Response resp = Response.status(Response.Status.UNAUTHORIZED).header(
                  "Set-Cookie",
                  cookieName+"="+sessionId+"; "+
                  "Version=1; Max-Age=0; Path=" + cookiePath + "; " +
                  "Expires=Thu, 01 Jan 1970 00:00:00 GMT").entity("").build();
  </code></pre>
  
  <p>(Only difference: 200 => 406).</p>
  
  <p>Is it true that cookies can't be set with 4xx responses?</p>