Fix Session::has with dot notation.
Don't set cookie if headers have been sent.