obrar.cgi not setting authorization response cookie

we have a resource protected by OAM webgate

we add a response of type (cookie) to the authorization policy applied for that resource

what we expect (after successful authentication) is that the webgate will set the response cookie after the execution of (obrar.cgi?encreply=......) of that webgate, so that the cookie value will be available during the execution of the next page (the protected resource).

actually this is not happened, and the webgate set the cookie after the execution of the protected resource (not before). which means the value will not be available during protected resource execution.

why this happening? and how can we fix that?