server: create AuthSession on /_session

Fixed request handler for /_session to send a new AuthSession cookie
when the client did not send AuthSession with the request.