don't touch headers without need
more obvious 405 and 501 status generation
list of arguments to Cookie.set()
managers can have their own managers now, bureaucrats!
request manager with query and body submanagers