Cannot set cookie in client from a Go API

I have a backend written in Go, hosted on Heroku, let's call it, https://foo.herokuapp.com. I have a frontend hosted on a different domain, let's call it, https://ui.example.com. The backend API has an endpoint /api/user/login which sends back a JSON Web Token in the form of cookie shown as below:

http.SetCookie(w, &http.Cookie{
        Name:     "token",
        Value:    token, // the JWT
        HttpOnly: false, // for testing, set to true later once I fix this
        MaxAge:   int(time.Hour * 24 * 3),
        Expires:  time.Now().UTC().Add(time.Hour * 24 * 3),
        Path:     "/",
        Secure:   true,
        SameSite: http.SameSiteNoneMode,
})

These are my CORS settings on the server.

crossOrigin := cors.New(cors.Options{
        AllowedOrigins:   []string{allowedOrigin},
        AllowCredentials: true,
        AllowedMethods:   []string{http.MethodGet, http.MethodPost, http.MethodPut},
})

The frontend makes a request to the backend as given below.

const endpoint = "/api/user/login/"
    fetch(host + endpoint, {
        method: "POST",
        credentials: 'include',
        body: JSON.stringify({
            email,
            password
        })
    }).then((response) => console.log(response))
    .catch((err) => console.log(err));

PROBLEM: Now this cookie is actually visible in my browser's Network tab.

But the cookie does not exist in the application tab (or Storage tab in firefox where cookies exist). The browser is not saving the cookie, which is causing the subsequent requests to fail as the token in the cookie is verified and decoded before processing the actual request.

In another somewhat related thread, I got to know that Heroku terminates SSL before reaching my app. And, thus secure cookies cannot be set for non-SSL traffic. The solution there suggests trusting the scheme found in X-Forwarded-For. I enabled that using using the https://github.com/gorilla/handlers package as follows.

// srv is my actual handler
// crossOrigin is the CORS middleware
// finally wrapped by ProxyHeaders middleware
handlers.ProxyHeaders(crossOrigin.Handler(srv))

Yet this is not working.

I read many threads/blogs. Nothing has worked so far. What am I doing wrong?