bugfix: forward clears context

Adds better tests for session propagation when using `forward` (as @xsawyerx suggested in #629).

In the two cases that we dispatch into a new app, grab the apps' session object before cleaning all app context. When a route match is found, add the request context and then set the session object only if the session object captured was for an app using the same cookie name.

If a route calling `forward` created a new session object, there would be no cookie object to use to associate the new session object with any app. Add a new cookie object when constructing the new request for `forward` to allow that association within the dispatcher.

Resolves #629.