From RFC 2109, "An origin server may include multiple Set-Cookie headers in a response. Note that an intervening gateway could fold multiple such headers into a single header."

Servers do return multiple Set-Cookie lines, for example (wrapping of line 10 is mine):
Qt Code: 
  1. Resolving www.doubleclick.com... 216.73.93.8
  2. Connecting to www.doubleclick.com|216.73.93.8|:80... connected.
  3. HTTP request sent, awaiting response...
  4.   HTTP/1.1 200 OK
  5.   Connection: keep-alive
  6.   Date: Tue, 05 May 2009 08:43:11 GMT
  7.   Server: Microsoft-IIS/6.0
  8.   X-Powered-By: ASP.NET
  9.   X-AspNet-Version: 2.0.50727
  10.   Set-Cookie: ecm=user_id=0&isMembershipUser=0&site_id=&username=&new_site=/
  11.      &unique_id=0&site_preview=0&langvalue=0&DefaultLanguage=1033&NavLanguage=1033&
  12.      LastValidLanguageID=1033&ContType=&UserCulture=1033&SiteLanguage=1033; path=/
  13.   Set-Cookie: ASP.NET_SessionId=arv3wz3p3eqaayff0d1duv45; path=/; HttpOnly
  14.   Cache-Control: private
  15.   Content-Type: text/html; charset=utf-8
  16.   Content-Length: 30533
  17. Length: 30533 (30K) [text/html]
To copy to clipboard, switch view to plain text mode