set-cookie headers should not include comma separated values

[yunong]

According to http://tools.ietf.org/html/rfc6265#section-3

   Origin servers SHOULD NOT fold multiple Set-Cookie header fields into
   a single header field.  The usual mechanism for folding HTTP headers
   fields (i.e., as defined in [RFC2616]) might change the semantics of
   the Set-Cookie header field because the %x2C (",") character is used
   by Set-Cookie in a way that conflicts with such folding.

set-cookie headers should not include comma separated values -- however, with PR #693 this is enabled comma separated values for all headers, including set-cookie, which breaks browser parsing of set-cookie headers.

[yunong]

fixed

[lrowe]

The HTTP RFC only disallows the merging of multiple Set-Cookie headers into a single header. Multiple Set-Cookie headers are common and necessary.

Testing back to the latest Node 4.x LTS release, resposne.setHeader("Set-Cookie", ["a=1", "b=2"]) will render a multiple Set-Cookie values correctly:

$ curl "http://localhost:3000/" -v
*   Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 3000 (#0)
> GET / HTTP/1.1
> Host: localhost:3000
> User-Agent: curl/7.43.0
> Accept: */*
> 
< HTTP/1.1 200 OK
< Set-Cookie: a=1
< Set-Cookie: b=2
< Date: Tue, 21 Nov 2017 20:19:28 GMT
< Connection: keep-alive
< Content-Length: 21
< 
* Connection #0 to host localhost left intact