Set cookie header when starting new session

Inner routes can have access to the newly created session instead of
recreating a new one each time they access it because the cookie header
is missing.