send headers after cookies in response
cookie settings cleanup in webresponse, HTTP-only flag for session cookie deletion call
ah bloody hell
moved global response creation from factories.xml to Controller::initialize, which also isn't a parameter holder anymore either (or does it have to be?)