Actual behavior (the bug)
I'm getting this issue in AWS Lambda - so this wouldn't be very common. However, if there are no cookies and you try to set a cookie then currently you can get an exception.

Expected behavior
Run as expected.

To Reproduce
Don't have cookies and set a cookie. I didn't do a test, but can show the code to fix.

Additional context
https://github.com/javalin/javalin/blob/master/javalin/src/main/java/io/javalin/http/Cookie.kt#L90

cookies.removeFirstKt()?.let { first -> this.setHeader(Header.SET_COOKIE, first.addSameSite(javalinCookie)) }

should become:

cookies.removeFirstOrNull()?.let { first -> this.setHeader(Header.SET_COOKIE, first.addSameSite(javalinCookie)) }

The ?. implies that you expect this to not bomb out if the remove call returns null.