On _save_session set cookie to response and not to request.response

request.response and response can be different if a view return a new Response
Merge pull request #1 from flibustenet/patch-1

On _save_session, set cookie to response and not to request.response