Rework how cookies are interacted with
Move session out of the request
Added bag tests