= servlet: make sure state is advanced when timeout triggers, fixes #522

A consequences of this simple solution is that once timeout handling has started, a legitimate response coming a bit late is always discarded. This handling of the race condition may be different from what spray-can implements (but this difference isn't deemed significant as the race-condition isn't handled deterministically anyways).