Cookie session fix

It was the `app` object on the ExpressJS request object which was causing this. Express uses it to store configuration on the request. For example: https://github.com/strongloop/express/blob/master/lib/request.js#L262 

I also threw in some other fixes to get the grunt tests going.
I agree that we should `app` throughout the application (heh), but the reason I used `ghApp` here is that it  conflicts with the ExpressJS `app` object in the outer scope.