HeaderSessionStrategy uses response.setHeader

Previously multiple headers might be outputed. This ensures that only a
single header is sent back with the session id.

Fixes #32