You can't set cookies from an SSI included script. (emphasis mine)

Gotcha - the server will send the header based on .shtml or .html (or however SSI is configured). By the time the included file tries to set a cookie, the header is complete.

That's what I was looking for. Thanks!