use err_headers_out for setting cookies instead of headers_out, so they persist on non-2xx/3xx statuses (Thanks to Joe Schaefer for this)