Oops.

Originally, I didn't have this here because I set the cookie during destroy_session.  But tests caught that that sets *two* session cookies, because they are pushed onto headers instead of replacing.  So this code migrated out here and I never made the method public.

I don't really like having to cache a destroyed session and having it public, but it's not the worst thing in the world.

An alternative would be to add a "session_cookie" attribute to Dancer::Core::Response and only push that to the headers in Dancer::Core::Reponse::to_psgi.  Then destroy_session in Context could set that on destroy, and the hook in App would overwrite it if a new session exists and the extra _has_destroyed_session clause could go away.

What do you think?