On _save_session, set cookie to response and not to request.response

request.response and response can be different if a view return a new Response