I believe you're confusing the idea of the script with the concept of page as it applies to the web browser.

The script generates a page with the form, the form is submitted by the user back to the script which handles the submitted params and generates a page with either success or failure. It is in that "page"'s headers that you set your cookie.

You basically had the logic right AFAICT in your original post's pseudo-code.