Dont set cookie header if not present

[fixes #338]

Trying to fix this problem on rubygems.org which uses clearance. The problem is well described in the issue.

### Solution
clearance always set the response cookie, even when is emtpy, so when doing a redirect, http->https, it would set an empty cookie, which is not what we want.
I cannot see any problem about not setting the cookie when it is empty. (please let me know if I miss something)

I hope CI passes, as I could not run tests locally ( see error: https://gist.github.com/arthurnn/e4bc23aecdc052870b0d )

review @derekprior