Moves session cookie setting from App to SessionFactory

The App now calls the SessionFactory to request that the cookie be set
instead of setting it directly into the Response.

This allows SessionFactories that need complete control of the cookie
(such as Cookie or PSGI) to override the default behavior.