make testing with cookies easier

- includes a util to mock cookies
- adds more tests for /session