add a couple of helper methods to aspen.Response
fix how we patch `datetime.utcnow()` in tests
use `aspen.utils.to_rfc822` instead of the obsolete `rfc822.formatdate`
only send a session cookie when it's actually needed