more robust session saving. Now we check if the response actually supports cookies, e.g. NotFound does not.