title: Set-Cookie header missing from ajax response in iOS 10.3
body: <p>My phonegap app communicates with django, so I use the method described in the following article to capture and send csrftoken:</p>
  
  <p><a href="https://docs.djangoproject.com/en/1.10/ref/csrf/" rel="nofollow noreferrer">https://docs.djangoproject.com/en/1.10/ref/csrf/</a></p>
  
  <p>This has been working till iOS 10.3. 
  In iOS 10.3, the ajax call gets all response headers except Set-Cookie.
  I tried adding xhrFields: {withCredentials: true} and crossDomain: true but it makes no difference.</p>
  
  <p>Here is the request to get the csrftoken:</p>
  
  <pre><code> $.ajax({beforeSend: function(xhr) {xhr.withCredentials = true;},
      type: "GET",
      url: 'url', // the django view has @ensure_csrf_cookie set     
      xhrFields: {withCredentials: true},
      crossDomain: true,
      success: function(data, textStatus, xhr) {
        // returns null in iOS 10.3
        document.cookie = xhr.getResponseHeader("Set-Cookie"); 
      },
  });  
  </code></pre>
  
  <p>The same code works fine in iOS 10.2 and we can save the csrftoken from "Set-Cookie" header for later use.<br>
  iOS 10.3 somehow prevents this "Set-Cookie" response header from appearing in the xhr object, thus we cannot get the csrftoken from server and any subsequent POST action will be forbidden.</p>