Go and gorilla sessions in Internet Explorer

I'm making a simple web app using Go, gorilla for sessions and routing, and mustache for templates. I'm having an issue with the login involving, I believe, a problem with IE accepting the cookie. The problem only occurs with Internet Explorer, but otherwise the login works perfectly in Chrome. Here is my code:

func main() {
r := mux.NewRouter()
r.HandleFunc("/performance", Index)
r.HandleFunc("/performance/login", Login)
log.Fatal(http.ListenAndServe(":5901", r))
}
func Index(w http.ResponseWriter, r *http.Request) {
session, _ := store.Get(r, "performance")
if session.Values["username"] == nil {
http.Redirect(w, r, "/performance/login", http.StatusSeeOther)
}
dict := session.Values
fmt.Fprintf(w, mustache.RenderFileInLayout("templates/index.html", "templates/basepage.html", dict))
}
func Login(w http.ResponseWriter, r *http.Request) {
if r.Method == "POST" {
results := 0
r.ParseForm()
u := r.FormValue("username")
pass := r.FormValue("password")
p := PassEncrypt(pass)
q := map[string]string{}
rows, err := db.Query("SELECT username, name, title FROM user WHERE (username=$1) AND (password=$2)", u, p)
if err != nil {
log.Fatal(err)
}
for rows.Next() {
var username string
var name string
var title string
if err := rows.Scan(&username, &name, &title); err != nil {
log.Fatal(err)
}
q["username"] = username
q["name"] = name
q["title"] = title
results++
}
if results > 0 {
session, _ := store.Get(r, "performance")
session.Options = &sessions.Options{
MaxAge: 900,
}
session.Values["username"] = q["username"]
session.Values["name"] = q["name"]
session.Values["title"] = q["title"]
session.Save(r, w)
http.Redirect(w, r, "/performance", http.StatusSeeOther)
} else {
http.Redirect(w, r, "/performance/login", http.StatusSeeOther)
}
} else {
fmt.Fprintf(w, mustache.RenderFileInLayout("templates/login.html", "templates/basepage.html", nil))
}
}

When logging in using IE the user is redirected right back to the login page because the session value "username" is nil, while in Chrome the username is correctly defined and the index page is served. For some reason IE is not accepting the cookie, yet I changed all settings in IE to allow cookies from any site. Do I need to change one of the cookie options or add something to the cookie other than "MaxAge" for IE to accept it? Thanks in advance.

You probably need to define the cookie's path in your options.
The following options struct should do the trick:

session.Options = &sessions.Options{
Path: "/performance",
}

Said option limits the cookie's availability to the given path, for the whole page
use "/".

Note that the max-age setting is not supported by IE:

> [...] Internet Explorer (including IE8) does not attempt to support any RFC for cookies.
WinINET (the network stack below IE) has cookie implementation based on the pre-RFC Netscape draft spec for cookies. This means that directives like max-age, versioned cookies, etc, are not supported in any version of Internet Explorer.

By the way, you don't need a MaxAge for session cookies (from the IE manual on cookies):

<!-- language: lang-none -->

(expires=date;)
If you set no expiration date on a cookie, it expires when the browser 
closes. If you set an expiration date, the cookie is saved across browser 
sessions. If you set an expiration date in the past, the cookie is deleted. 
Use Greenwich Mean Time (GMT) format to specify the date.

This should be the case for all major browsers.

I had a similar problem where logout would not work on IE9, using Gorilla sessions (although login worked fine).

I eventually discovered that IE was caching the responses to my API endpoints and sending the cached (304 NOT MODIFIED) API responses to the client, even though the cookie values where changing.

Forcing the API endpoints to never be cached fixed the problem:

w.Header().Set("Expires", "Tue, 03 Jul 2001 06:00 GMT")
w.Header().Set("Last-Modified", "{now} GMT")
w.Header().Set("Cache-Control", "max-age=0, no-cache, must-revalidate, proxy-revalidate")