Move Heroku cookie from middleware to Sinatra extension

The trouble with the middleware is that without special logic, it will
respond to all requests, including static assets, which I believe can
result in a race condition under particular circumstances (as browsers
parallelize requests), especially when the middleware unsets the cookie
if it wasn't originally present.

This will ensure that we only try to change this cookie on paths
directly related to authorization. Unfortunately, it could result in
some drift between the Heroku cookie and main session on modules like
`Account`, but it probably would hurt to register this extension there
as well (after it looks like this is working).

Related to the usual suspects #74, and #77.