I have traced the response/request with firebug and it is reproducible that when commenting out the one line that adds the header the authentication works and the cookie is set, whereas when I set the header no cookie is set and hence the client cannot log in.