Hello,
Your second statement overrides the first one.
You should call .header("Set-Cookie"...) only once.
Example :
.header("Set-Cookie", "cookie1=das;cookie2=asd;HttpOnly")
Side note: you should consider a StringBuilder to concatenate several cookies.
Best Regards