The fix for CR: 5017051 causes cookies to be set for 401 Unauthorized responses, but the Cookie header has already been set for the initial request. Therefore 2 Cookie headers are being set. This causes a problem for some asp's running on IIS.

example:

telnet IIS_Server 80
Trying IIS_Server...
Connected to IIS_Server.
Escape character is '^]'.
GET /b.asp HTTP/1.0
Cookie: A=0; B=0
Cookie: A=0; B=0

HTTP/1.1 200 OK
Date: Thu, 01 Dec 2005 09:53:06 GMT
Server: Microsoft-IIS/6.0
Content-Length: 585
Content-Type: text/html

You provide A: 0
<hr/>
You provide B: 0%2CA=0
<hr/>
Connection to 129.158.215.247 closed by foreign host.


where the code of b.asp is:
-------------
You provide A: <%=Response.Write(Request.Cookies("A"))%> <hr/>
You provide B: <%=Response.Write(Request.Cookies("B"))%> <hr/>
-------------

This may appear as a regression from 1.5