fix session handling

using res.cookie was incorrect, and using the same array of
seenQuestions for all requests - modified to use express session -
although without a session store, so session data will not persist
between server restarts