...because our login code was explicitly closing all headers after sending the cookie header
I am not sure what you mean by "closing all headers". Do you mean sending a blank HTTP line to indicate start-of-body? Is this a security technique to keep somebody from hijacking the headers?