国外服务器
This can: http://tengine.taobao.org/changelog_cn.html#1_4_3

我记得好像不行吧，ngx.location.capture / ngx.socket 是不能在 set_by_lua 里面用的

不行，set_by_lua 是运行在 rewrite 阶段，并且：
『This directive is implemented by injecting custom commands into the standard HttpRewriteModule's command list. Because HttpRewriteModule does not support nonblocking I/O in its commands, Lua APIs requiring yielding the current Lua "light thread" cannot work in this directive.』
http://wiki.nginx.org/HttpLuaModule#set_by_lua

貌似今天刚刚发布的 1.7.1 里可以了：
http://nginx.org/en/docs/http/ngx_http_upstream_module.html
$upstream_cookie_name
cookie with the specified name sent by the upstream server in the “Set-Cookie” response header field (1.7.1). Only the last server’s response header fields are saved.
一会试验一下。