Unable to recreate JSESSIONID cookie in Internet Explorer

Question

Hello All,
(Running  CF Version: 9,0,0,251028,   Windows 2008 Server,  IIS-7)
I am using the code below to expire the JSESSIONID cookie that is generated by CF because CF does not set the "HTTPOnly" and "Secure" cookie attributes by default when the JSESSIONID is initially created .  I am then recreating the JSESSIONID cookie with the required attributes.
This works great for all browsers EXCEPT Internet Explorer!
When the code below runs in Internet Explorer, the JSESSIONID cookie does become expired as it should as seen in the 1st line of the function below.  However, The script after that fails to recreate the JSESSIONID in Internet Explorer.  this is driving me nuts because it works like a charm in ALL other browsers.
I am aware of the solution which involves setting these attributes in an xml configuration file on the CF server.  However that solution is not an option for me.  I am forced to use the method below to setup my secure/httponly JSESSIONID cookie.  Any ideas would be greatly appreciated!!!
<cffunction name="OnSessionStart" output="false" access="public" description="I fix the sessionid">  
         <cfcookie name="JSESSIONID" expires="now"/>              
       <cfscript> 
          var.HTTPOnly = "HTTPOnly";
          var.domain = cgi.server_name;       
          var.path = "/";
          var.secure = "Secure;";                         
          var.response = getPageContext().getResponse();              
          var.header = "JSESSIONID" & "=" & session.sessionid & ";domain=." & var.domain & ";path=" & var.path & ";" & var.secure & var.HTTPOnly;
          var.response.setHeader("SET-COOKIE", var.header);             
        </cfscript>       
        <cfreturn />
  </cffunction>

Answer 1

Below is the responseHeader dump (from IE9).
Looks the exact same in FireFox and Chrome.  However,  a cfdump of the cookie scope will reveal (JSESSIONID=), nothing, zip, zilch, nada in IE9. Since the JSESSIONID cookie value is empty or null, a login attempt will result in a flash of the screen and the user is never logged in.
While a cfdump of Firefox and Chrome happily display a valid JSESSIONID cookie value and allow users to login to my application just fine.
(Note:  The secure attribute is intentionally turned off due to my non-ssl dev pc.)
Cache-Control
no-cache, no-store, must-revalidate
Connection
close
Content-Type
text/html; charset=UTF-8
Date
Sat, 10 Sep 2011 19:35:08 GMT
Explanation
OK
Http_Version
HTTP/1.0
SET-COOKIE
struct
1
JSESSIONID=843032102a51ca7bfa0f60831221c8642e45;domain=.localhost;path=/;HTTPOnly
2
JSESSIONID=843032102a51ca7bfa0f60831221c8642e45;path=/
3
JSESSIONID=;expires=Fri, 10-Sep-2010 19:35:08 GMT;path=/
Server
JRun Web Server
Status_Code
200
X-Frame-Options
deny
X-XSS-Protection
1; mode=block
expires
{ts '2011-09-10 15:35:08'}
pragma
no-cache
Thanks for the help!
Neil