Regardless of it being a 301, the cookie or token is already sent, and thus already burned, by the time the response code is returned. Your API should not even

Regardless of it being a 301, the cookie or token is already sent, and thus already burned, by the time the response code is returned. Your API should not even be listening on port 80, period.