Fix tests

We handle differently invalid or expired session identifiers for
stateful sessions by default, by renewing the session state. Of course
if I don't update the test cases, the travis build will continue to
fail...
Remove useless directive

It is not necessary to set the cookie in the header for each request,
but only when the session gets created otherwise we end up having plenty
of useless cookies sent to the client.