Session: Changed sendCookie and Response to protected to allow extension/overloading