title: Expiring a cookie when sending a redirect response not working
body: <p>I'm trying to invalidate/expire an insecure cookie from a securely accessed servlet and send a redirect back to the client.  However, when the redirect is followed, the request still contains the original, unexpired, uninvalidated (is that a word) cookie.</p>
  
  <p>Here's a more detailed description of the flow:<br />
  1) Client requests a particular insecure url backed by Servlet A. <br />
  2) Servlet A detects that there is a Cookie XX and redirects to a secure url backed by  Servlet B <br />
  3) Servlet B does its magic, then invalidates Cookie XX by setting the MaxAge to 0 and redirects to Servlet A via an insecure url. <br/>
  4) In Servlet A, I'm still able to access the cookie just as it was in the first request.</p>
  
  <p>Can anyone lend a hand?  I was under the impression and can't find evidence to the contrary that when a cookie is sent back with a redirect response, it is still processed before the new request is sent out.  This is happening in all browsers (Chrome, FF, IE) that I have access to, so I don't think its a browser thing.  In HTTPFox and the Chrome Developer tools I can see the original cookie getting sent in the first and second request, the invalidated cookie coming back in the response to the second request, and the original cookie being sent again in the third request.  I've tried setting the MaxAge to 0, setting the value of the cookie to null/empty string, and another value but it never changes.  All of the server side code is done in Java if it matters.</p>
  
  <p>Help is very much appreciated.</p>