title: Should a cookie header be set on every response?
body: <p>Let's say you're implementing sessions.</p>
  <p>You check whether the browser presents a session cookie. If yes, you authenticate the cookie and find the user that the session is associated with, and move on processing the request.</p>
  <p>If you don't find a session cookie, you create a new session and send a cookie to the browser whch you expect to receive on subsequent requests.</p>
  <p>Now my question is: if you did find a session cookie in a request, would you <strong>resend</strong> the same cookie in the response. Under what circumstances is this right?</p>
  <p>Note: I ask this as a Pyramid (Python) programmer, because Pyramid implementation sends the session cookie unconditionally on every response. (<a href="https://github.com/Pylons/pyramid/blob/master/pyramid/session.py" rel="nofollow noreferrer">go to code</a>)</p>