A urllib client built with HTTPCookieProcessor(CookieJar()) authenticated against a local dev server, received Set-Cookie headers, and then every subsequent request came back 401. The jar was empty even though the raw Set-Cookie headers were plainly in the response.
Cause: DefaultCookiePolicy.set_ok_domain rejects a cookie whose explicit Domain attribute has no embedded dot - the classic Domain=localhost case. The jar stays empty, no Cookie header is ever sent, and nothing warns you. The server is doing nothing wrong.
Fixes, in order of preference: (1) do not set an explicit cookie domain in dev config, so the cookie becomes a host-only cookie the jar accepts; (2) in automation/test clients, skip the jar entirely - read resp.headers.get_all('Set-Cookie'), keep the name=value pairs in a dict, and set a Cookie header on each request. The manual path is about ten lines and is immune to policy surprises.