session: simplify set-cookie