Regardless of it being a 301, the cookie or token is already sent, and thus already burned, by the time the response code is returned.

Your API should not even be listening on port 80, period.