JsessionID is set by application server, not Pega7. It is used for load balancing / session affinity.

Pega associates browser calls with requestors via the PegaRULES cooke, which is the requestorID.

HTTP headers may only be available to authentication activities - there would be an object pxHTTPServletRequest on the Requestor page which you cast to an HTTPServletRequest then use java methods. 

Below find an old code fragment showing access to cookies.  There is a property pyHTTPResponseHeaders on pxRequestor page that might be a way to set response headers. Have not done it or researched fully. 

javax.servlet.http.HttpServletRequest req = null;

try{

req = (javax.servlet.http.HttpServletRequest)tools.getRequestor().getRequestorPage().getObject("pxHTTPServletRequest");

javax.servlet.http.Cookie[] cookies = req.getCookies();

String token = null;

if (cookies != null) {

      for (int i = 0; i < cookies.length; i++) {

          if(cookies[i].getName().equals("XXXX"))

              ID = cookies[i].getValue();

         }

      }

if(EmployeeID.equals(""))

{

  ID = "ID is not available in Cookies, Please contact System Administrator";

  tools.putParamValue("Status","fail");

  tools.putParamValue("errMsg",errorMessage);

  tools.putParamValue("pyChallenge",errorMessage);

  throw new PRRuntimeException(errorMessage); 

}

}catch(Exception e)

{

throw new PRRuntimeException("Custmom LDAP Exception : "+e.getMessage());

}