why /j_security check not return login-token in response header?

[#1]

Scenario is I have Login form and I want to make request to /j_secirity_check which gives token in return. but in my case i called /j_security_check but its not setting 'set-cookie' in response header. I am not getting why /j_security check not return login-token in response header?

Note- AEM server is production server and author instance

[#2]

you can get token by simply calling /libs/granite/csrf/token.json

Does it work in lower environment? the login cookie is created when user is able to login successfully. Can you see login-token cookie? if yes then check if dispatcher is removing cookie header