Moved session destruction to context

Sessions are now destroyed via the context object.  This is necessary
because sessions are managed in multiple places and need synchronized
behavior.

In addition to destroying the session via the factory, when a session is
destroyed we need to expire the existing session cookie and send it
back in the response, but only if another session does not replace it.

Likewise, once a session is destroyed, we must ignore the existing
request session cookie and not attempt to retrieve it again.

As a side benefit of this change, Dancer::Core::Session objects no
longer need a link back to their factory, which makes for cleaner
design.

This commit includes more extensive session lifecycle tests.