[ajax] Can an AJAX response set a cookie?