action hook on wp_signon not firing until user goes to wp-admin

I am building a login bridge from wordpress to a legacy site. I am trying to create a hook off wp_signon that will build a cookie for the the legacy system.

Everything works - except the cookie is only built if the user goes to the wp-admin/* pages. Anybody have any thoughts?

Streamlined code:

add_action( 'wp_signon', 'qplb_login');
function qplb_login($login) {
// get user info from legacy...
// build legacy cookie
setcookie ('osrlogin[pid]',row[pid], time() + 16000, $cookie_path, '', $is_https);
}