use setCookie instead of building a header manually

Instead of manually constructing a cookie, use the setCookie method
provided by Transport. This prevents the following kind of condition:

Imagine:
- application runs setcookie with null params to delete a cookie.
- application runs session_regenerate_id to get a new session id.
- session_regenerate_id then constructs a new header through
m_responseHeaders.

Eventually, Transport will generate headers, but will always put
m_responseCookies after m_responseHeaders in the full header.

Uh oh! Now we have accidentally deleted a cookie due to incorrect header order.
Merge branch 'session_cookie'