Bump release version for '0.3.7'
controllers/login: Set cookie expiry on logout

This changes the logout cookie behaviour to instead return an expired
header, rather than a cookie with a short life span.

Issue #233.
Refactor cookies logic into model
controllers/login: Clean up comment rot
Merge branch 'release/0.3.7'