OK - so the code itself works.
Ah - include.
That explains it I am afraid - jsp:include is equivalent to a RequestDispatcher.include which javadoc explicitly says: "The ServletResponse object has its path elements and parameters remain unchanged from the caller's. The included servlet cannot change the response status code or set headers; any attempt to make a change is ignored." (from
http://java.sun.com/j2ee/1.4/docs/api/javax/servlet/RequestDispatcher.html - and it had not changed in newer versions)
The cookie is a header... so you just cannot do it from there.
So you need either to move the cookie somewhere else or to find another way to get the servlet code in the JSP.