core: avoid session rename when authenticating from websocket.

In case a postback results in calling z_auth:logon/2, we should not
rename the session if we have already sent a session cookie.
For properly detecting this, we need to store the `set_session_id`
flag in the session instead of in the context.

--

This is a rather minor fix, but possibly with side effects I'm not aware of, hence a review before committing it to master.

I've tried it on my dev setup, naturally. And so far I've not seen any issues with it.

What it solves in my case, specifically, is that it allows me to send a postback with 
a signed logon request, which when verified results in a call to z_auth:logon (or signup, in case it's a unknown user). 

I use it on my new mod_persona module, which won't work without this fix ;)
(or by solving the rename session issue some other way)