= servlet: make sure state is advanced when timeout triggers, fixes #522

A consequences of this simple solution is that once timeout handling has
started, a legitimate response coming a bit late is always discarded.
This handling of the race condition may be different from what spray-can
implements (but this difference isn't deemed significant as the
race-condition isn't handled deterministically anyways).