Make sure there isn't a blank line anywhere between the Content-Type and the Set-Cookie. The blank line marks the end of the headers and the start of the content.

If I remember correctly (but it's been years), Set-Cookie SHOULD -- as opposed to MUST -- appear after Content-Type, meaning it's ok to put it before the Content-Type.