session is stored before sending response!

This allow to save session even if a plugin or an auth system has to redirect before handlers could execute!