fix new-session issue, clear set-cookie header

The set-cookie header gets passed to any ESI call, resulting in each ESA falling to the backend and not being cached if varnish would otherwise only call once and cache for cases where multiple ESI URLs are the same.