detect cookie capability before login

and only add the session ID to the URL if the browser doesn't support cookies.
 
Previously the check for the session id cookie always failed in the
first response after a login, because the session id cookie wasn't set yet.

(Note that with this change, you must set `$Config->{SriptAlias} = ''` if you use the Plack handler; previously it "worked" even with a wrong ScriptAlias by adding the session ID to the URL).