move cookie, session, flash initialization into request.c