destroy_session clears session objects from engines

When a session is examined for the first time within a request, its added to every defined engine within the app. If `app->destroy_session` was then called, only the session within the app was being cleared. Any engines that subsequently examined their session attribute had no knowledge that the session had in fact been destroyed.
Resolves #681.

This Pr includes the test case (slightly modified) @DavsX put together from #682. Some refactoring of code in Core::App that iterated over all defined engines, then finally ensuring we clear the session attribute in every engine as part of the call to `app->destroy_session`.