fix long-time bug: was recreating session cookies unnecessarily for many requests - should only create a session cookie on /session/set.