Fix EZP-22751: DELETE /user/sessions/<id> does not remove the session cookie