Fix httpSetCookie to only allow one header per cookie
Fix httpCreateSession to always re-create a session
Fix httpDestroySession to erase the client cookie (API change)