I have an iframe that:
You may want to look into why your browser is doing a POST rather than a GET, since that implies that there's an important piece of information that you left out. No browser will follow a HTTP/302 redirect with a POST.
In IE9, redirection responses are cached if headers allow (IE8 and below would not cache redirects).
You can absolutely set a cookie on a 302 redirect. There are two possibilities here:
Given that you're having this problem in an IFRAME, #1 seems more likely. (See Quick Look at P3P)