[BUGFIX] Fix race condition in session shutdown
This protects sessions against being revived through the shutdown
method even though they were destroyed remotely in the meantime.
This patch also contains a small modification and related test to make
sure that incoming session cookies are not blindly sent back to the
user agent in the response. Instead, a clean, new session cookie with
the parameters set in Flow's settings is created.