diff --git a/examples/cookie_auth/cookie_auth.c b/examples/cookie_auth/cookie_auth.c
index 6111e62a..f349ba14 100644
--- a/examples/cookie_auth/cookie_auth.c
+++ b/examples/cookie_auth/cookie_auth.c
@@ -58,11 +58,11 @@ static int check_pass(const char *user, const char *pass) {
  * or NULL if not found.
  */
 static struct session *get_session(struct http_message *hm) {
-  struct mg_str *cookie_header = mg_get_http_header(hm, "cookie");
-  if (cookie_header == NULL) goto clean;
   char ssid_buf[21];
   char *ssid = ssid_buf;
   struct session *ret = NULL;
+  struct mg_str *cookie_header = mg_get_http_header(hm, "cookie");
+  if (cookie_header == NULL) goto clean;
   if (!mg_http_parse_header2(cookie_header, SESSION_COOKIE_NAME, &ssid,
                              sizeof(ssid_buf))) {
     goto clean;
diff --git a/mongoose.c b/mongoose.c
index 6349adc1..31a2e1ea 100644
--- a/mongoose.c
+++ b/mongoose.c
@@ -8526,7 +8526,8 @@ MG_INTERNAL void mg_send_http_file(struct mg_connection *nc, char *path,
 #endif
   } else if (mg_is_not_modified(hm, &st)) {
     /* Note: not using mg_http_send_error in order to keep connection alive */
-    mg_send_head(nc, 304, 0, NULL);
+    /* Note: passing extra headers allow users to control session cookies */
+    mg_send_head(nc, 304, 0, opts->extra_headers);
   } else {
     mg_http_serve_file2(nc, index_file ? index_file : path, hm, opts);
   }
diff --git a/mongoose.h b/mongoose.h
index 03d128d0..ad35234f 100644
--- a/mongoose.h
+++ b/mongoose.h
@@ -23,7 +23,7 @@
 #ifndef CS_MONGOOSE_SRC_COMMON_H_
 #define CS_MONGOOSE_SRC_COMMON_H_
 
-#define MG_VERSION "6.15"
+#define MG_VERSION "6.16"
 
 /* Local tweaks, applied before any of Mongoose's own headers. */
 #ifdef MG_LOCALS
diff --git a/src/mg_common.h b/src/mg_common.h
index f49335dd..3d8fe2e4 100644
--- a/src/mg_common.h
+++ b/src/mg_common.h
@@ -20,7 +20,7 @@
 #ifndef CS_MONGOOSE_SRC_COMMON_H_
 #define CS_MONGOOSE_SRC_COMMON_H_
 
-#define MG_VERSION "6.15"
+#define MG_VERSION "6.16"
 
 /* Local tweaks, applied before any of Mongoose's own headers. */
 #ifdef MG_LOCALS
diff --git a/src/mg_http.c b/src/mg_http.c
index e4901685..b9c946b8 100644
--- a/src/mg_http.c
+++ b/src/mg_http.c
@@ -2692,7 +2692,8 @@ MG_INTERNAL void mg_send_http_file(struct mg_connection *nc, char *path,
 #endif
   } else if (mg_is_not_modified(hm, &st)) {
     /* Note: not using mg_http_send_error in order to keep connection alive */
-    mg_send_head(nc, 304, 0, NULL);
+    /* Note: passing extra headers allow users to control session cookies */
+    mg_send_head(nc, 304, 0, opts->extra_headers);
   } else {
     mg_http_serve_file2(nc, index_file ? index_file : path, hm, opts);
   }