Move cookie/header management to header module. In core was causing strange (and scary) behaviour under load. This stops session "bleed" but under very heavy load headers/cookies will be nil/nil