fix #1287: Make sure expired cookies get removed from session.cookies

This changes sessions to update their cookiejar directly from the headers rather than the cookiejar attached to responses. This way cookies that the server marks as expired are removed from the session cookiejar.