Session: Changed sendCookie and $response to protected to allow extension/overloading

Session: sendCookie also can't be private in order to allow extension/overloading