As the article states:

the nice thing about this is that the browser will keep sending the credentials to subsequent requests of the same domain until it receives a 401 status as response.

You don't need to set anything, just send a 401 if you want the browser to stop sending credentials. You don't even need cookies.