Set-Cookie would only exist on the first requests where the server actually tells the client to set a cookie. On subsequent requests, the client would inform the server about the cookie (using the Cookie header), so this would have to match both requests and response headers.