sessions: Destroy session cookies when the session is modified.

This test appears to have been dead code before, because session types don't
have __nonzero__() or __len__() defined and so it would not really be possible
to get to the innermost clause of this test.

This causes cookies to not be set spuriously for empty sessions on one of my
applications, which in turn causes Varnish to not refuse to cache certain
views. It's a win for everybody!