Cookie session fix

It was the `app` object on the ExpressJS request object which was causing this. Express uses it to store configuration on the request. For example: https://github.com/strongloop/express/blob/master/lib/request.js#L262 

I also threw in some other fixes to get the grunt tests going.
Ah, yes, good point. I've reverted this in master