title: Owin cookie authentication set-cookie not saving in browser
body: <p>I am building self-hosted web server on this stack:
  OWIN
  Nancy
  Web Api 2</p>
  
  <p>And I am using Microsoft.Owin.Security.Cookies from Katana for forms-like authentication. I got Set-Cookie header in response, but cookie don't being saved and not being included in next request. So what's the problem? What I am doing wrong?</p>
  
  <h2>Owin startup:</h2>
  
  <pre><code>app.UseCookieAuthentication(new CookieAuthenticationOptions()
          {
              AuthenticationMode = AuthenticationMode.Active,
              AuthenticationType = "GM",
              CookieHttpOnly = true,
              CookieSecure = CookieSecureOption.SameAsRequest,
              CookiePath = "/",
              CookieName = CookieAuthenticationDefaults.CookiePrefix + "GM",
              CookieDomain = "localhost",
          });
  </code></pre>
  
  <h2>Controller code:</h2>
  
  <pre><code>var context = Request.GetOwinContext();
  context.Authentication.SignIn(new AuthenticationProperties()
      {
          IsPersistent = true
      },
      new ClaimsIdentity(new[] {new Claim(ClaimsIdentity.DefaultNameClaimType, user.Login)}, "GM"));
  context.Response.Headers.Add("Location", new []{ "/" });
  return Request.CreateResponse(HttpStatusCode.Found);
  </code></pre>
  
  <h2>Response headers:</h2>
  
  <pre><code>Cache-Control:no-cache
  Content-Length:0
  Date:Wed, 11 Sep 2013 11:11:23 GMT
  Expires:-1
  Location:/
  Pragma:no-cache
  Server:Microsoft-HTTPAPI/2.0
  Set-Cookie:.AspNet.GM=AQAAANCMnd8BFdERjHoAwE_Cl-sBAAAABui2rBibE0yPXB0-v3C06gAAAAACAAAAAAAQZgAAAAEAACAAAAC1mQV3jGo_WAhMQ-hzsmzgkdbdCclWIAX-msbE0_12zQAAAAAOgAAAAAIAACAAAABuQjBg3EJIka151hvBgtlPGfQ2O_cwNI2VVh86dchTDXAAAAD21O9DnNk4yLU9eddVfY3bT9P1CEudNeLvwohkSTAQBP2onuIQfgl9F99Je5waPddckh2llD2kjftSMQPhzgE9vKm-_wE42hXhc9FIgfxpD5AdaeGatwpEcwDfGJJdpQnObX1pbjEFIXLVJxGm5qMUQAAAAC8AiFTaXmzrfRy4-jR6zqMmSKddzddmiBLGClAckWOy6W2YWdf50N2zhIj_MwN8-zi-B0tlv87pzAt-6RDZYZs; domain=localhost; path=/; expires=Wed, 25-Sep-2013 11:11:24 GMT; HttpOnly
  </code></pre>