I'm not sure we want to alter Dancer::Core::Response with session-specific data (here the "session_cookie" attribute). I think that the Response class should not know about a "session".

It's fine for me if in your current branch, the private methods are renamed with public names.