Synchrony will sometimes return Set-Cookie headers if using XHR fallback mode

If using XHR fallback mode, synchrony will sometimes return headers like the following. "Set-Cookie: JSESSIONID=dummy". This will cause the current user to be logged out.

Steps to reproduce

You will likely need a proxy to reproduce this bug - the internal synchrony proxy is not suitable as it has been patched.

1. Setup Synchrony and Confluence on the same domain and port. Confluence must be configured to run on the root of the domain. ie http://localhost:8080/
2. Disable websockets so that Confluence will use XHR fallback mode
3. Logout and clear all cookies
4. Add a random cookie via the console

   document.cookie = "this.is.important=false;"
   

1. Login to confluence and edit a page
2. Notice the xhr and xhr_send requests return a Set-Cookie header which consequently log you out

Possible Workarounds

• Use the internal proxy
• Filter out Set-Cookie headers at the external proxy
• Rename the Session cookie tomcat uses as shown in Option 2 section