Better cookie domain support

1.  We noticed that sometimes, based on other middleware we wrote, we'd return a `Request` object without a `session` or `user` attribute.  So we instead check to see if the attribute is available, now.

2.  We now issue `delete_cookie` to *either* the SESSION_COOKIE_DOMAIN or the custom domain you may be on.  This behavior should have been in the initial patch, and without it we had some lingering issues in our testing.