Fix for get_sid/1 and get session

Any newly set cookie should get precedence over lingering (old) cookies
that exist in the Req.

Return undefined when a session doesn't exist instead of throwing badarg